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Message from the Chief Audit and Evaluation Executive 


As the Canada Border Services Agency's (CBSA) internal audit and program evaluation functions both report to the Chief Audit and 
Evaluation Executive, the Internal Audit and Program Evaluation Directorate continues to take advantage of this synergic opportunity to 
integrate the two functions within its planning exercise activities. The integration efforts provide the Agency with highly valued insight as part 
of its oversight continuum. 


As part of our continued integration effort, | present you our third iteration of the plan, the CBSA's 2017 Risk-Based Audit and Evaluation 
Plan. The audit and evaluation projects identified in this document respond to the requirements, priorities and risks of senior management 
and meet the legislative and compliance requirements of the Govemment of Canada. 


Claudette Blair 
Chief Audit and Evaluation Executive 


PROTECTION * SERVICE * INTEGRITY 


Canada 


000005 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information. 


FINAL 
| Canada Border Agence des services 
d Services Agency frorialers du Canada PROTECTED A 


Deputy Head Confirmation 


| hereby approve the CBSA’s third integrated Risk-Based Audit Plan and Five-Year Program Evaluation Plan for the 2017-2022 audit and 
evaluation activities, which | submit to the Treasury Board of Canada Secretariat (TBS) as required by the Policy on Internal Audit and the 
Policy on Results. 


The 2017 Risk-Based Audit and Evaluation Plan conforms to applicable Government of Canada requirements, including: 


e The Policy on Internal Audit and the Government of Canada Internal Audit Standards contained therein and the supporting guidance 
for risk-based audit planning put forth by the Office of the Comptroller General; and 

e The Policy on Results: this Departmental Evaluation Plan meets the requirements of the Mandatory Procedures for Evaluation and 
supports the requirements of the expenditure management system including, as applicable, Memoranda to Cabinet, Treasury Board 
submissions, and resource alignment reviews. The CBSA does not administer grants and contributions programs. 


The CBSA is committed to remaining innovative and to improving its overall relevance, performance, risk management, governance and 
controls. As such, the approach taken to develop and implement this document is in line with our modernization efforts. 


| will ensure that this plan is updated annually, and | will provide information about its planning and implementation to TBS, as required. 


John Ossowski 
President 
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1.0 Introduction 


1.1 Background 


This Risk-Based Audit and Evaluation Plan (RBAEP or the Plan) outlines the 2017-2022 audit and evaluation activities for the Canada 
Border Services Agency (CBSA or the Agency). The Plan provides background information on the Agency's Internal Audit and Program 
Evaluation Directorate (IAPED). It also describes the overall context and methodology used in its development and presents the proposed 
internal and extemal audit and evaluation activities approved for future years. 


A departmental Risk-Based Audit Plan (RBAP) and a Five-Year Program Evaluation Plan (FYPEP) are both required under the Policy on 
Internal Audit and the Policy on Results, respectively. For a third consecutive year, an integrated approach has been taken to ensure that 
audit and evaluation products and services are optimally aligned and of greatest benefit to the CBSA. 


The Plan was developed based on various activities such as the review of key documents; a risk assessment exercise of the Agency's 
2017-2018 Program Alignment Architecture (PAA) and draft program inventory under the 2017-2018 Departmental Results Framework 
(DRF) conducted by IAPED employees; consultations with the Branch Liaison Contacts (BLC) representatives’; consultations with Agency 
senior management and the external Audit Committee (AC) members; as well as consideration of the requirements of the Treasury Board 
Secretariat (TBS). It has been designed to ensure appropriate coverage of the Agency's risks and the PAA. It is updated and presented 
each year to the CBSA Performance Measurement and Evaluation Committee (PMEC) and the AC for their review and recommendation 
for approval by the President, in advance of its required submission to TBS. 


1.1.1 Overview of the IAPED? 


The IAPED's mission is to foster management excellence, performance, and accountability through the provision of professional insight 
and advice. To this end, the IAPED's vision is to be a key, valued and sought-after partner and contributor to the Agency's strategic and 
management decision making and an active player in support of the Agency's oversight regime, supporting its continuous modernization. It 
acts as an educator and an enabler to the CBSA by providing not only an insightful perspective but also punctual advice to senior 
management for enhanced and timely decision making. 


For that reason, the IAPED's goal is to be a valued contributor that provides assurance to the Minister, President and senior management 
on the organization's control framework, governance, risks, relevance, and performance of the Agency's programs and activities. 


The IAPED has completed its third and final year of its transformation agenda. In 2014-2015, the IAPED committed to substantially 
transform, over three years, the delivery of its audit and evaluation products and services by focusing on four key streams: 


1. Strategies and Directions — Establishing common directions and strong foundations for the IAPED; 

2. Products — Enabling the provision of meaningful insight into Agency programs, governance, risk management, and controls through 
leading-edge, client-focused products; 

3. Clients — Transforming the relationship of the IAPED with management; and 

4. Profession — Being recognized as a leader in the internal audit and evaluation communities. 


Leveraging on this foundational transformation agenda, the internal audit and evaluation functions will continue to work closely together as 
two important pillars of the Agency's oversight continuum. The functions are mutually supportive, with important synergies between them, 


1 Designated CBSA employees in each Branch responsible for coordinating responses to IAPED requests. 
2 All of the IAPED's key initiatives and resources are detailed in its Integrated Business Plan. 
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and yet are professionally distinct, with each uniquely contributing value to the Agency. The table below outlines some of the contributions 
made by each function. Taken collectively, each function provides vital information in support of management's oversight and decision 
making responsibilities. 


Overall 
purpose 


What is 
examined? 


Overall 
questions 


Table 1: Key Contributions and Synerg 


"Internal auditing is an independent, 
objective assurance activity designed to 
add value and improve an organization's 
operations. It helps an organization 
accomplish its objectives by bringing a 
systematic, disciplined approach to 
assess and improve the effectiveness of 
risk management, control, and 
governance processes." 

-International Standards for the 
Professional Practice of Internal Auditing 


Risk management 
Control 
Governance processes 


Are the governance, risk management 
and control systems designed 
appropriately and adequately to 
mitigate risk and to respond efficiently 
and effectively to management's 
needs? 

Are the practices implemented in the 
areas of governance, risk 
management and control working as 
intended fo support the achievement 
of objectives? 


Evaluation 


“In the Government of Canada, 
evaluation is the systematic and neutral 
collection and analysis of evidence to 
judge merit, worth or value. Evaluation 
informs decision making, improvements, 
innovation and accountability. 
Evaluations typically focus on programs, 
policies and priorities and examine 
questions related to relevance, 
effectiveness and efficiency. Depending 
on user needs, however, evaluations 
can also examine other units, themes 
and issues including alternatives to 
existing interventions. Evaluations 
generally employ social science 
research methods.” 

-Treasury Board Policy on Results 


e Relevance 
e Effectiveness 
o Outcomes 
Efficiency 
o Inputs 
o Outputs 


ls there an ongoing need for the 
program? 

Does it align with government 
priorities? 

Does it align with federal roles and 
responsibilities? 

Is it achieving its expected (or 
intended) outcomes? 

Does the program demonstrate 
efficiency and economy? 


ies of the Audit and Evaluation Functions 
Value of Synergies 


Together, the two 
functions provide 
credible, independent 
and neutral advice to 
inform decision making. 
The work done by one 
function positively 
influences the business 
intelligence for the other 
and plays a role in 
defining a scope. 


By focusing on different 
questions, both functions 
can strengthen overall 
program management 
operations whether they 
are examining programs, 
policies or internal 
services. 


1.1.2 Tables of Planned Resources? 


3 As of May 4, 2017. 
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The Plan has been designed with the objective of allocating resources to the areas of highest significance, while ensuring judicious 
evaluation coverage of the Agency’s PAA. Table 2 provides a breakdown of the full-time equivalent (FTE) positions by division and the 
Director General's Office, while Table 3 outlines the financial budget for 2017-2018. The $4.3 million allocated for salary allows for 


approximately 47 of the 54 positions to be fully staffed. It is not expected that the salary limitation will affect timely delivery of the Plan as 
the IAPED has recently established long-term contracts to complement its capacity and address resourcing needs. 


Table 2: 2017-2018 IAPED FTE Positions by Division (not all funded 


Director Generals | alema Audi neon — Ed PEER Professional Total FTEs 
Office Division Practices Division 
RE RS 2 | | [AE |] 9 | 


22 13 


Table 3: 2017-2018 IAPED Budget by Division‘ 


MEN] Say | OEM | Budget 


SS < 


O&M | Salary | O&M | 
$237,280 | $1,141,157 | $176,856 | $4,333,281 | $957,932 | $5,291,213 


Director General's Program Evaluation 
Office Division 


Salary | O&M | Salary | O8M | Salary 


Internal Audit Division | 


$405,192 | $72,436 | $1,686,060 | $471,360 | $1,100,872 


1.1.3 Structure 


The 2017 RBAEP outlines, in an integrated manner, the schedule for the priority engagements related to the audit function from 2017-2018 
to 2019-2020, including external engagements managed by the Professional Practices Division (PPD). It also outlines the evaluation 
schedule to cover the Agency's direct program spending from 2017-2018 to 2021-2022, including horizontal evaluations also managed by 
the PPD. 


^ O&M does not include $479,820 for eManifest, as this is separate from the IAPED's A-base funding. 


PROTECTION + SERVICE + INTEGRITY 


Canada 


000009 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information. 


FINAL 
| Canada Border Agence des services 
vi Services Agency frorialers du Canada PROTECTED A 


2.0 Planning Context 


2.1 External Factors 


The IAPED has identified, through a review of various documents, such as the 2016-2017 CBSA Environmental Scan, the following 
upcoming changes in the external environment that may have an impact on its planning activities and its ability to deliver: 


1. Geopolitical global context: International borders have never been under greater pressure and the increasing movement of people and 
goods shows no signs of reduction. The complex nature of the CBSA’s mandate, through our administration of more than 90 acts, 
regulation and intemational agreements, makes it at the forefront of the Government of Canada’s activities. 


2. Canada-U.S. political context: In November 2016, Donald Trump was elected as the 45^ President of the United States. In his first 
week in office, President Trump signed several executive orders including: build a border wall between the U.S. and Mexico; increase 
the number deportations of those in the country illegally, including hiring 10,000 more Immigration and Customs Enforcement agents, 
and block federal grants to so-called "sanctuary" cities; speed approval of the Dakota Access and Keystone Oil Pipelines using 
American-made steel and materials; and withdraw the United States from the Trans-Pacific Partnership negotiations. 


3. Canadian political context: A new government was elected in October 2015 and priorities have changed. Even if the CBSA's core 
mandate is unchanged, the shifting of government priorities and a workload increase have impacted the CBSA, most notably the 
Syrian Refugee Initiative. In particular, the Prime Minister's expectations include improving economic opportunities and security for 
Canadians, a strong focus on results, and work informed by performance measurement, evidence, and feedback from Canadians.5 


4. Canada 150: The New York Times declared Canada the number one country to visit in honour of the 150 anniversary of the 
confederation. The Canadian federal government has budgeted about $500 million dollars for Canada 150 celebrations, projects and 
major events, including free admission to all national parks and historic sites to domestic and international visitors. Montreal is also set 
to celebrate its 375" anniversary with events including urban renewal, light shows and major celebrations happening in the city 
throughout the year. 


5. Increasing border crossings: Since April 2016, more than 400 refugee claimants have illegally crossed the border into Canada from the 
U.S. Under a current agreement with the United States, Canada generally does not allow refugee claims from within the U.S., 
designating that country a "safe third country." The most popular border crossings have been into the province of Manitoba and 
Quebec, with expectations for numbers to increase as the weather warms and the crossings become less dangerous. Following a 
unanimous vote, Montreal became a "sanctuary city," alongside Toronto, Vancouver, and London, for undocumented migrants to 
receive municipal services without fear of being deported. 


6. Opioid crisis: Fatalities linked to fentanyl in Canada have increased over the last four years, with the highest increases seen in British 
Columbia (7-fold) and Alberta (20-fold). Fentanyl is 50—100 times more powerful than morphine with a kilogram of pure fentanyl 
powder costing $12,500 with one kilo being enough to make 1 million tablets. Each tablet sells for about $20 in major cities. 
key source country of the illicit drug that is being imported into Canada, with suppliers concealing fentanyl powder in silica packages or 
hidden in commercial and industrial goods, shipped by regular air mail or by courier. 

7. Ongoing implementation of the Policy on Results: The 2009 policy was evaluated in 2014 and TBS modified the policy. However, 
some changes included in the Policy on Results are still being implemented: departments have until November 1, 2017 to implement 
subsections of this policy as they relate to the DRFs, Program Inventories and Performance Information Profiles. In the meantime, 


5 Minister of Public Safety and Emergency Preparedness Mandate Letter. http://pm.gc.ca/eng/minister-public-safety-and-emergency-preparedness- 
mandate-letter (as of January 18, 2017). 
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departments must continue to implement, maintain and use the existing structure. The CBSA has volunteered to pilot with TBS the 
transitioning of its evaluation planning exercise toward the Policy on Results’ requirements. 


Increased scrutiny by the Office of the Auditor General (OAG): The Agency is increasingly involved in OAG audits. While important, 
these audits require significant time and effort on the part of the Agency. The CBSA is one of the most solicited partners by external 
assurance providers as well as partner departments in issues related to border protection, refugee management and commercial 
trans-border movement issues. 


Stakeholder expectations on the nature of internal audit are evolving: Deputy Ministers have expressed the desire to see the function 
evolve from only providing assurance to providing both assurance and also foresight. The AC, the TBS Office of the Comptroller 
General (OCG) and the Institute of Internal Auditors are always considering new methods and a new vision to provide optimal value to 
stakeholders. In addition, the Minister of Public Safety is expected to report regularly on progress toward fulfilling commitments and to 
help develop effective measures that assess the impact of the organizations for which he is accountable.$ 


Phoenix pay system: The new federal government pay system completes more than 8.9 million transactions valued at approximately 
$17 billion/year. Government-wide, there is a risk of non-payment to public servants and the resulting non-compliance with terms and 
conditions of employment for employees of the public service. At the Agency, this risk has been mitigated by compensation advisors 
retained by the CBSA, resulting in fewer instances of non-payment. The IAPED has considered the risks and the work being 
conducted by other assurance providers (e.g., OAG, Public Services and Procurement Canada's intemal audit function, and potentially 
the OCG) in deciding to not proceed with an audit or evaluation on this topic at this time. 


Resourcing issues in audit and evaluation: The two functions require that employees possess specific competencies and certifications 
that are in high demand across all federal departments and the private sector, with a limited availability of potential candidates. The 
IAPED uses a co-sourcing model in which a mix of federal government employees and contractors is used to deliver audit and evaluation 
products in order to meet the Plan. The utilization of external contractors possesses benefits (e.g., additional capacity and subject matter 
expertise) as well as drawbacks (e.g., limited knowledge of the Agency) and therefore, its use is carefully determined within the planning 
phase of each project. 


Internal Factors 


In addition to external factors, the following internal issues may impact the ability of the IAPED to deliver its commitments: 


1. 


Strategic Directions: In 2016-2017, this initiative was launched to solidify the CBSA's vision into the year 2030. The framework lays out 
the Agency's series of proposed priorities in relation to the outcomes that it seeks to achieve. It is based on a vision drawn from the 
Agency's mandate, and on the action plans and initiatives that must be undertaken to achieve these outcomes. This framework will 
serve as the foundation for setting future priorities and change the Agency's planning approach. These future directions are being 
taken into consideration in the IAPED's work in terms of significant changes in certain programs that may occur. 


The CBSA Renewal initiative: This initiative was launched on February 8, 2017 to examine the Agency's resource base in all areas in 
order to ensure that it is allocating it towards govemment priorities and ensuring the sustainability of operations for years to come. The 
objectives of the CBSA Renewal involve developing a comprehensive, evidence-based analysis of all of the CBSA’s programs and 
operations and provide analysis of key cost drivers; ensuring that the CBSA’s activities are relevant, measurable, efficient, and aligned 
With the government's priorities and commitments; determining whether the CBSA's funding levels are appropriate to enable the 
efficient delivery of the CBSA’s mandated activities; re-prioritizing resources, making adjustments to program design, or eliminating 
poorly targeted or inefficient programs and activities that are peripheral to the CBSA's mandate; and improving the CBSA's business 


ê Ibid. 
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model and explore opportunities for revenue generation or other resourcing arrangements that are responsive to program needs as 
non-discretionary workload volumes and costs may change or increase. Recognizing the importance of this review, the IAPED has 
ensured that its selection of projects in 2017-2018 align with this important initiative in order that findings from the IAPED 
engagements may complement and better inform senior management decision making, ultimately contributing to the success of the 
CBSA Renewal initiative. 


3. Branch engagement: The nature and quality of the IAPED's work relies on its ability to build on the collaboration and engagement with 
other branches within the CBSA. The workload and resource constraints of internal clients and partners may have an impact on their 
level of engagement with the IAPED, which can in turn affect the timeliness and quality of the IAPED's products. Through the BLC 
forum held every quarter and the increased deployment of the TeamMate" software, the IAPED is always seeking innovative and 
automated solutions to alleviate the audit and evaluation burden on the CBSA's operations, improve the quality of its products, and 
strengthen its relationships with clients, internally and externally. 


3.0 Methodology 


The IAPED has made improvements with regard to the development of its 2017 Plan. In addition to conducting an internal risk assessment 
exercise based on specific risk factors, the IAPED also increased the consultations within the Agency. New projects were identified based 
on the risk assessment exercise with the BLC and branch senior management. The validation of the selected projects was conducted 
through the same consultations process as well as a discussion at the AC to ensure that the Plan addresses the most significant risks to 
the CBSA. Beyond traditional audit and evaluation reports, the IAPED will continue to offer consulting engagements to the President in an 
effort to provide the Agency with additional advice that is valuable and timely. 


The following key steps were followed to develop the Plan: 
3.1 Step 1: Review of the IAPED Oversight Universe 


The oversight universe defines the potential scope of internal audit and evaluation activities and is comprised of entities that may be 
subjected to them. These areas represent a holistic view of all potential auditable and evaluable units, such as program areas, functions, 
structures, funded initiatives or internal services that collectively contribute to the achievement of the Agency's strategic outcome. For the 
CBSA, the oversight universe has been defined as its PAA. This Plan used the 2017-2018 Agency PAA to develop the schedules, which is 
presented below (see graphic 1, next page). The Agency's draft Program Inventory is a subset of the programs identified in the PAA and is 
therefore very similar. 


7 TeamMate is audit management software that is also used at the CBSA by the evaluation function. The software will increase the efficiency and 
productivity of audit and evaluation project delivery. 
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Graphic 1: 2017-2018 CBSA PAA 
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3.2 Step 2: Mapping of Previous Coverage 


To guide the selection of audit and evaluation projects as part of the Plan, the IAPED continuously updates the previous work that has 
been completed and areas within the Agency that have already been covered by the IAPED's oversight. As such, the mapping of previous 
audits and evaluations completed since 2004-2005 was updated, including external activities. This exercise contributed to understanding 
what has already been accomplished in previous years and the type of issues highlighted by these projects, which helped the selection of 
future projects based on our past activities. 


3.3 Step 3: Identification of Projects 


While audit projects identified typically focus on high-risk areas, as mentioned under point 7 of section 2.1, this year being a transitional 
year for the Policy on Results, the evaluation projects continue to mostly cover the Agency's PAA. The projects were identified by 
accomplishing the following steps: 


1. Review of key CBSA documents: A review of Agency information included the 2016 Enterprise Risk Profile (ERP), Branch Risk 
Profiles, the Agency's Departmental Security Plan 2016-2019, the CBSA Departmental Plan 2017-2018, the draft 2017-2018 DRF and 
Program Inventory, the CBSA 2016-2017 Environmental Scan, as well as numerous other related planning documents such as 
Treasury Board commitments (from Memoranda to Cabinet and Treasury Board submissions). 


2. Riskassessment exercise conducted by IAPED employees: Employees were asked to risk assess the oversight universe based on the 
information gathered during the conduct of past work and other key known source of information. The risk assessment exercise used 
the following five risk factors: 


e Internal Control Systems (the weaker the controls, the greater the risk); 
e Perceived Sensitivity/Public Visibility (the greater the sensitivity/visibility, the greater the risk); 
e Date Since Last Engagement (the farther the date, the greater the risk); 
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e Materiality (the greater the materiality, the greater the risk); and 
e Strategic Importance to the CBSA (the greater the importance, the greater the risk). 


At the end of the risk assessment exercise, the Chief Audit and Evaluation Executive (CAEE) reviewed and validated the final results. 


3. Consultations with the BLC representatives and Agency's senior management: Multiple consultations occurred with the Branch 
Management Tables, and the CBSA President and Executive Vice-President. Each consultation involved a discussion of the 
operational risks for the CBSA's programs, whether the risks have changed in the past year, as well as any emerging risks. Later, their 
input was also sought on the proposed schedules to know if there are any contingencies with the delivery of their activities. 


4. Consultations with TBS: The Policy on Results requires that large departments and agencies engage in consultations with TBS during 
the annual evaluation planning exercise in the development of the FYPEP. A pilot was created in January 2017 and the IAPED 
participated along with six other organizations that were selected based on set criteria (e.g., sector, size). Lessons leamed are to 
inform full implementation with all departments. 


The first step involved a review of the Agency's 2016-2017 evaluation plan by the TBS Results Division analyst to learn about its 
evaluation landscape (i.e., past and future planned evaluations). 


The next step involved the analyst meeting internally within TBS with his CBSA program sector analyst counterpart and director to 
provide observations from the review of the draft CBSA evaluation plan, and to gather feedback from a program sector lens. 


The final stage involved a meeting on February 9, 2017, between TBS and the IAPED in which feedback was provided on the planned 
future evaluation projects. The feedback provided at this meeting was incorporated into the evaluation schedule. In addition, the 
IAPED consulted with TBS to provide updates and negotiate extensions to evaluation commitments made as part of TB submissions 
and Memoranda to Cabinet. The results of these consultations are also reflected in the timing of individual evaluations noted as TB 
commitments in the evaluation schedule. 


5. Consideration of internal and external planned engagements: As part of its planning exercise, the IAPED considered the work of 
intemal assurance providers such as the Comptrollership Branch's Intemal Control Review Plan and the plans of external assurance 
providers such as the OCG and the OAG to avoid duplication. In addition, the IAPED considered planned horizontal evaluations 
across government as part of its coverage and burden calculations. 


6. Consultations with external AC members: Similar to the consultations with senior management, the extemal members were asked for 
advice and input on validating the proposed schedules. The risk information obtained not only provided important insight into the 
concerns of senior management and extemal members, but it also provided a more timely and accurate understanding of risks and 
risk exposure. Subsequently, this information was used to prioritize and validate the selection of possible new audit and evaluation 
projects and to finalize the audit and evaluation schedules. 


34 Step 4: Selection and Timing of Projects 
Selection 
The selection of projects employed a comprehensive approach. After the risk assessment exercise and the consultations were conducted, 


some of the audit and evaluation projects approved in the 2016 Plan were validated to remain. The addition of new projects was made 
based on the methodology used to develop the Plan. 
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Consulting engagements continue to be inserted as placeholders into the audit and evaluation schedules to respond to senior 
management's needs. These engagements are performed outside of the traditional audit and evaluation activities, support the CBSA's 
needs in a different manner and are responsive to the IAPED new value proposition agenda. The Plan allowed for some resources to be 
assigned to consulting engagements, with the understanding that the Plan would focus predominantly on assurance audits and evaluations 
that ensure meeting transitional goal of the new TBS requirements. 


Timin 
When possible, the timing of each project was established considering numerous criteria, including: 


Agency areas of high risk and significance 

Specific commitments from Memoranda to Cabinet and Treasury Board submissions 
Ongoing and planned external coverage (OAG, OCG, etc.) 

Coordination with intemal assurance providers 

Senior management priorities, including the CBSA Renewal initiative 

Previous audit and evaluation coverage 

Coordination between audit and evaluation projects, including potential joint projects 
Knowledge of existing issues and status of implementation of improvements 


40 Detailed RBAEP 


This section presents scoping procedures, capacity assumptions, and adjustments made since the 2016 Plan. It also presents the audit 
and evaluation schedules and a brief description of each internal audit and evaluation project to be started during the first year and the first 
quarter of the second year of the Plan. Consulting engagements are also explained. 


Scoping Considerations 


At the CBSA, each audit and evaluation project scope is determined in consultation with the Office of Primary Interest (OPI) and the Office 
of Secondary Interest (OSI) during the planning phase. As per audit standards, the nature and scope of audit engagements are ultimately 
determined by the Internal Audit Division. The engagement plan for each audit considers the Agency strategies, objectives, and risks 
relevant to the engagement. 


In terms of evaluation projects, their scope is determined in collaboration with the responsible Directors General through the Evaluation 
Advisory Committees (EACs) and is presented to the PMEC for approval before the research phase begins. The EACs ensure that the 
OPIs and OSls are engaged at each phase of the evaluation to ensure that findings and recommendations are well understood by program 
and senior management. These processes ensure added value for program management and consider the Agency's information needs, 
while meeting the standards set by Treasury Board policies. 


Capacity Assumptions 


To determine the resource requirements for the proposed internal and external audits and evaluations, it is necessary to make a number of 
assumptions related to the average cost per project, average resource consumption per project and overhead costs (e.g., translation, 
travel, etc.). These estimates are based on previous internal audits and evaluations completed by the IAPED. The following are the key 
assumptions with respect to delivering this Plan: 
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e The IAPED budget allocations for the three- or five-year period will remain at the 2017-2018 levels. If this budget is reduced, the 
IAPED may not be able to complete all of the projects as scheduled. The budget identified in Table 3 is sufficient for the completion of 
this Plan. 

e The Internal Audit Division will complete, on average, a minimum of 7 audits (including reviews and follow-ups) and one consulting 
engagement per fiscal year. 

e The Program Evaluation Division will complete, on average, a minimum of 4 evaluations per fiscal year. The consulting engagements 
will start in 2017-2018. 

e  Notall projects require the same level of effort. The number and level of FTEs assigned to a project depends on the complexity level of 
the project. 

e Internal projects require an average of 12 months to complete. In addition, the Plan allocates one quarter for AC or PMEC 
presentations as well as one quarter to the external publication process. 

e Consulting engagements typically involve work of a shorter duration than audit/evaluation projects. 

o (Intended to provide added value in a timely manner to senior management, consulting engagements involve a more 
simplified process compared to the typical IAPED projects. 

e Depending on the scope of the projects, additional professional resources or outside expertise may be required (e.g., international 
benchmarking, subject matter experts, etc.). 


4.1 Adjustments 


This section provides a comparison between the 2016 and 2017 Plans. It is important to note that the planning and program environment is 
dynamic; accordingly, as the Plan is revisited each year, adjustments are occasionally required to ensure it is responsive to emerging 
Agency risks. 


4.1.1 Audits 
The following changes have been made to the internal audit schedule: 
Audits Removed: 


1. Trade Delivery (AC: Q4 2017-2018): Cancellation was approved at the December 2016 AC meeting. The OAG conducted an audit of 
Customs Duties which covered a large portion of the Agency's Trade Program. In addition, the IAPED recently examined other areas 
of the Trade Program, including the 2015 Audit of B2 Refunds. 

2. Values and Ethics (AC: Q1 2018-2019): Removed due to the coverage of this area in the Professional Standards audit and the OAG 
Audit of Preventing Corruption. 


4. Travel and Hospitality (AC: Q4 2018-2019): Removed due to low risk and coverage of financial controls in the RBAEP. 
5. One HR (AC: Q1 2019-2020): This PSC commitment was ultimately conducted by the PSC itself, with results presented to senior 
management in March 2017. 
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Audits Added: 


Entry/Exit (Review) 

Border Controls for Marine Ports of Entry (Follow-Up Audit) 

Revenue Collection at the Border (Account Revenue Ledger (ARL) and Cash Management) 
Occupational Health and Safety 


B2 Refunds (Follow-Up Audit) 


2 32% 9 018% D = 


0. 
1. 
Other minor changes were made to some audit projects mainly to ensure proper sequencing of engagements: 


eManifest has been postponed by one quarter; 

Advance Commercial Information System has been postponed by one quarter; 

HR Planning (OCG Horizontal Audit) has been advanced by two quarters to ensure participation in this horizontal audit; 

Account Revenue Ledger (ARL): as mentioned above, this audit is now part of the Revenue Collection at the Border audit and has 
been postponed by three quarters; 


e Entry/Exit has been delayed by eight quarters to await the full implementation of the project. 
4.1.2 Evaluations 

The following changes have been made to the program evaluation schedule: 

Evaluations Not Included: 


1. Anti-Dumping and Countervailing (PMEC Q1 2016-2017): New evaluation not added due to recent coverage in 2016-2017. This 
program area amounts to 0.3896 of organizational spending. 

2. Trusted Traveller (PMEC Q3 2016-2017): New evaluation not added due to recent coverage in 2016-2017. This program area 
amounts to 1.6196 of organizational spending. 


Evaluations Added: 


1. Consulting Engagement - 3ls Integration (Intelligence Collection and Analysis, Criminal Investigations, Immigration Enforcement): 
initially planned as an audit, this project will now be a consulting engagement conducted by evaluation. 

eManifest 

Detection technology 

Performance Management 

Postal Modernization Initiative 


€ & © D 
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Other changes to evaluation projects were made, mainly to balance previous coverage: 


e Single Window Initiative, which is now a horizontal evaluation led by the CBSA, has been postponed by seven quarters to ensure the 
availability of performance data; 

e Hearings will be evaluated individually while Detentions and Removals will be evaluated as part of the 31 Integration project; 

e Commercial Facilitation and Compliance has been delayed by ten quarters due to previous coverage; 

Science and Engineering has been delayed by two quarters to allow for the advancement of the Interactive Advance Passenger 

Information (IAPI) evaluation; 

Infrastructure and Materiel has been delayed by nine quarters due to previous audit coverage; 

Security Screening has been delayed by seven quarters due to recent audit coverage; 

Intelligence will be evaluated as part of the 31 Integration project; 

Trusted Trader has been delayed by eleven quarters due to previous coverage; 

Trade Facilitation and Compliance has been delayed by three quarters due to recent OAG coverage; 

Criminal Investigations will be evaluated as part of the 3I Integration project; 

Entry/Exit ( has been delayed by eight quarters to await the full implementation of the project; 

IAPI has been advanced by six quarters given its TB commitment status and high risk; 

Targeting has been delayed by five quarters due to previous coverage; 

Force Generation will start nine quarters earlier due to lack of previous coverage and strategic importance to the Agency; and 

Immigration Investigations will be evaluated as part of the 3I Integration project. 


Going forward, the evaluation plan will be further adjusted to align with the Agency's Program Inventory developed under the new DRF 
requirement. Given the draft nature of the 2017-2018 DRF, the Plan has taken this inventory into consideration in terms of potential future 
coverage requirements. Any future changes required to the RBAEP schedules will be reported, discussed and approved quarterly at the 
AC and PMEC. 


4.1.3 External Engagements 


The external engagements are also subject to modifications on an annual basis, based on the respective planning exercises of external 
providers. The following changes have been made to the Plan: 


External Engagements Removed: 


Refugee Protection Programs (lead: OAG); 

Oversight of Immigration and Citizenship Consultants (lead: OAG); 
Detentions and Removal Status Report (lead: OAG); and 

Issuing Visas (lead: OAG). 


To D = 


External Engagements Added: 


Departmental Progress in implementing Sustainable Development Strategies (lead: OAG); 

Serving Canadians Abroad - Consular Services (lead: OAG, primary entity is Global Affairs Canada (GAC)); 
Federal Tourism Strategy (lead: OAG, primary entity is Industry Canada); 

Real Property (lead: OAG, primary entity is GAC); and 

CBSA Transactions and Financial Information (formerly known as Public Accounts) (lead: OAG). 


An ES D = 
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4.1.4 Horizontal Evaluations 


The horizontal evaluations are also subject to modifications on an annual basis, based on the respective planning exercises of other 
federal departments. The following changes have been made to the Plan: 


Horizontal Evaluations Removed: 


Integrated Proceeds of Crime (lead: Public Safety (PS)) 

Beyond the Border Action Plan (lead: Royal Canadian Mounted Police (RCMP)); 

Investment to Combat Criminal use of Firearms (lead: RCMP); 

Pre-Inspection and Preclearance (lead: PS);and 

Coastal and Anti-Terrorism Funded Marine Security Operations Centers (lead: National Defence). 


Ce & © D = 


Horizontal Evaluations Added: 


1. Asylum Reforms (lead: Immigration, Refugees and Citizenship Canada); 
2. Crimes against Humanity and War Crimes (lead: Justice); 

3. Guns and Gangs (lead: PS); and 

4. Federal Tobacco Control Strategy (lead: Health Canada). 


Other minor changes were made to the horizontal evaluation projects: 
e International Mobility Program (lead: IRCC) will start three quarters later; 


e Federal Contaminated Sites (lead: Environment) will start two quarters later; and 
e Anti-Money Laundering and Anti-Terrorism Financing Regime (lead: Finance) is starting three quarters later. 
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4.2 Internal Audit Schedule 


Office of F'rimary Interest Source of eis 2017-2018 2018-2019 2019-2020 2020-2021 2021-2022 


(Director General Level) Commitment PAA 


Planned Projects 


ah 
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As nem omptrollership Branch: Infrastructure " " 
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omptrollership Branch: Agency Policy on Internal Audit 
omptroller 


7 7 2 y omptrollership Branch: Strategic 
rocurement and Contracting Policy on Internal Audit IS AS 


perations 
IST Branch: Commercial Portfolio / 
TB Commitment 1.2.1 AG 


Programs Branch: Commercial 
Programs 


7 Qua A CENE Branch Business Applications Policy on Internal Audit iz 
— a AW UE ROIS SSSR 

i du on O C 

To Ba Eu B 


ty 44/4. |Comptrollership Branch: Agency 
= NE Etolleroperatons Branch: TB Commitment IS/1.1 
= ay em erations 


ce Branch: Labour Relations and 
| [Compensation 


Policy on Internal Audit 


Z [Prosrams eranen: Traveler Programe [re commiment [1f | | | CT L1 01] 1] 1| L1 à 
S Programs Branch: Traveller Programs |TB Commitment 


Upcoming AC dates are as follows: Q1 - June 2017; Q2 - October 2017; Q3 - December 2017; Q4 - April 2018. 
** Program includes a Beyond the Border initiative component, or is a stand-alone Beyond the Border initiative. 


IS = Internal Services 
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43 Internal Audit Project Profiles 


In this section, a brief description for each internal audit project starting in the first year of the planning horizon and the first quarter of the second year is presented, along with 
preliminary objectives, scope, selection rationale, resource estimates, alignment with the CBSA Oversight Universe, risk ranking and alignment with the CBSA ERP. Note: Each 
preliminary proposed project objective and scope will be validated during the planning phase of the engagement through project preliminary risk assessment. 


Table 4: 2017-2018 Project Profiles — Internal Audit 
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The preliminary objective of this aud i i pp y partners may not allow the CBSA to assess 
adequacy of application controls in business process potential risks to the health, safety and security of Canadians. 

systems used to advance collect air cargo and conveyance Risk that the Agency may be unable to administer trade legislation and agreements. 
information, and to assess the completeness of the CBSA Risk that the Agency may be unable to enforce other government department requirements and 
data management control framework. The focus of ensure that they are met. 

application controls audit work could be with the Customs Risk that the Agency may be unable to collect duties and taxes on imported goods. 

Electronic Commerce Platform (CECP) and Accelerated Risk that information provided by external stakeholders prior to the arrival or departure of goods 
Commercial Release Operations Support System may not be complete, accurate or valid. 


(ACROSS) systems. Risk that data quality issues may limit the CBSA's ability to meet the Agency's objective of 


The scope could also include review of the compliance intercepting high-risk or unknown cargo prior to arrival in Canada and to improve carrier 


program in place or plans to monitor carrier compliance with compliance and correct the gaps. 
advance data reporting requirements. 

The review of the data management control framework 

could assess management support and direction for data 

management practices, data ownership and management 

responsibilities, data management procedures, performance 

indicators and training for data management staff. 


Salary: 3.5 FTE 2 | Internal Services — Information un e Intelligence and Analysis 
O&M: $18,500 Technology : e Security 

e Trade Revenue 

e Facilitation 

e IM/IT 


PROTECTION « SERVICE = INTEGRITY 23 


Canada 


000023 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


B Canada Border Agence des services FINAL 
Services Agency frontaliers du Canada PROTECTED A 


PROTECTION « SERVICE = INTEGRITY 24 


Canada 


000024 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Ee Canada Border Agente dés savice FINAL 
: ervices Agency rontaliers du Canada PROTECTED A 


EZEE 


The preliminary objective of this aud 
assurance that Agency responsibilities for marine ports are 
appropriately carried out and managed. 
The audit scope could include the effectiveness of controls 
and procedures at the border in inspecting high-risk 
containers arriving at marine ports, as well as the Agency's 
use of results of examinations to improve the process for 
inspecting high-risk containers at the border. 
The audit could follow up on the findings and 
recommendations of the 2012 and 2015 (targeting) internal 
audits, including: 
reviewing and improving the effectiveness of the TITAN 
risk scoring methodology for marine container 
targeting; 
implementing a cost-effective, statistically sound 
program; 
monitoring to ensure examination results are accurately 
and consistently recorded in TITAN; 
clarifying and communicating how the penalty regime is 
applied; 
reviewing and improving security marine container 
handling and storage; 
strengthening controls; and 
confirming and monitoring the timetable to demonstrate 
ihe benene realization of the Bay Plan 


e Facilitation 
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The preliminary objective of the audit is to determine 
whether the controls over revenue, including controls 
relating to ARL and revenue collection at the border, are in 
place and function as intended. 

The audit scope could include an assessment of compliance 
with applicable policies and comparison of the controls and 
practices in place related to at-border revenue collection 
(traveller and commercial) in the air, land and marine modes 
(e.g., cash management reviews on regional ports of entry). 
Areas in scope for the ARL portion of this audit could 
include assessing the effectiveness of controls (e.g., 
payment processing, targeted broker strategy to clean up 
accounts, financial reporting), the business support model 
(i.e., how the Agency supports change for Border Services 
Officers (BSOs) and stakeholders as it moves into the 
second phase of CBSA Assessment and Revenue 
Management (CARM)), security, privacy, as well as training 
for cashiers and brokers. 

The audit could include an assessment of progress in 
addressing recommendations resulting from previous audits, 
reviews, and health checks following ARL implementation. 
The audit could take into consideration the Agency 
Comptroller's Internal Control Review Plan for 2017-2020, 
which includes testing of key internal controls for ARL in 
WE 2018. 


GR COSE 


1.1/ Internal Services - Financial 
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Risk that revenue receipts and deposits may not be adequately managed and processed in 
compliance with policies. 
Risk of insufficient oversight of regional cash management controls. 
Risk of inconsistencies in regions’ processes and practices. 
Risk of losses due to waste, abuse, misstatements, mismanagement, errors, frauds, omissions or 
other irregularities. 
Risk that data system weaknesses may prevent effective Agency monitoring and testing. 
Risk of inconsistency between invoices and remittances, requiring manual intervention. 
Risk of payments being made without proper documentation to support their allocation. 
Risk that the broker/importer community may not have the adequate knowledge to present and 
process remittances in the system. 
Risk that the Agency be unable to verify the net amount (invoices less remittances) due from 
importers. 
Risk that the CBSA may be unable to provide a sufficient level of audit evidence regarding its 
taxes receivable, consequently impeding the OAG's ability to conclude on the taxes receivable 
balance for the annual Transactions and Financial Information audit. 
Risk that there may be issues with extracting information from the ARL system (i.e., query system 
timeouts requiring additional time to request information). 
This audit is part of a TB commitment. 


— Alignment to CBSA ERP Risks. 


ELS 


° Trade Revenus 


Salary: 4.5 FTE 


O&M: $75,000 Management / Information Technology e IMIT 


e Organizational Culture 
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E — objective of this audit is to provide 
assurance that the Agency's occupational health and safety 
(OHS) program is meeting the requirements of the 
legislation, regulations and directives that govern 
occupational health and safety. 

The scope of this audit could be of a compliance nature. Its 
focus could be on the higher risk activities required by 


employees to accomplish the Agency's mandate as well as 
OHS matters such as injury on duty, worker's 
compensation, and refusal of dangerous work. It could also 
consider the overall control framework and the extent to 
which the Agency has mitigated key risks identified through 
Job Hazard Analysis reports. 


d 


do 
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O&M: $16,500 Oversight and Human Resources 


| Risk that employees refuse to work. 
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Risk that the Agency may be unable to adequately provide employees, and in some cases the 
public, with a safe and healthful working environment. 

Risk that Agency employees may be subject to physical, chemical, biological, ergonomic and 
psychosocial health hazards, as well as mechanical, working at heights, and mobile equipment 
safety hazards. 

Risk that the Agency may not comply with OHS legislative requirements, approved standards, 
policies and directives. 

Risk that Agency employees may not have the necessary equipment, training instruction and 
supervision to safely carry out their duties on behalf of the CBSA. 

Risk that workplace committees may not adequately monitor and/or track incidents including the 
monitoring of trends, statistics or number of accidents/incidents. 

Risk that fentanyl and other emerging synthetic opioids may come across the border, creating a 
situation where BSOs may come into contact with the drug while performing examinations, which 
presents a significant health risk. 


SU MELOS M 
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Office of Primary Interest Source of E 2017-2018 2018-2019 2019-2020 2020-2021 2021:2022 
(Director General Level) Commitme nt 


SOOO OTT Policy on Results 
o — TB Commitment 


Consulting 
Engagement 


Policy on Results 


ograms Branch: Enforcement and 
telligence 


Fe E 


IST Branch: Commercial Portfolio / 
Programs Branch: Commercial Programs 


_ EE 
o o tren nmn Raa | Polley on Results 


Y 


— — — = | [Compt ollerehip Branch Infrastructure and [oricy on Results 
Intelligence 


Mar E o HR Branch: HR Programs Policy on Results 


au ad 


Policy on Results 


SI ET EN EU 


14 
Programs Branch: Commercial/Traveller Policy on Results 12 
Programs 


Program Spending Coverage 

Upcoming PMEC dates are as follows: Q1 - May 2017; Q2 - September 2017; Q3 - November 2017; Q4 - February 2018. 

* Program is not a one-to-one match with a program or sub-program in the PAA. 

** Program includes a Beyond the Border initiative component, or is a stand-alone Beyond the Border initiative. 

N/A = The cost of this program is included within another larger program already accounted for in this plan or does not apply. 
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4.5 Evaluation Project Profiles 


In this section, a brief description for each evaluation project starting in the first year of the planning horizon and the first quarter of the second year is presented, along with 
preliminary objectives, scope, selection rationale, resource estimates, alignment with the CBSA Oversight Universe, risk ranking and alignment with the CBSA ERP. Note: Each 
preliminary proposed project objective and scope will be validated and calibrated during the planning phase of the engagement through evaluation calibration. 


Table 5: 2017-2018 Project "E 3 Program Zu 


D ecc nm m ge 
Relevance: Is there a continuing need for the program? Is the This program area has never been evaluated. 
program aligned to government and departmental priorities? Is the The 2016 internal audit of Immigration Enforcement examined the Detentions, Removals, and 
program aligned with federal roles and responsibilities? Hearings sub-programs and found that data integrity challenges made it difficult for the overall 
program to produce accurate, reliable and timely program performance information. 
Performance (Effectiveness): Are outcomes being achieved? Hearings has been identified by TBS and senior management as an area to be evaluated 


l given its lack of previous evaluation coverage. 
Performance (Efficiency and Economy): How are resources 


utilized in relation to the production of outputs and progress toward 
expected outcomes? 


The preliminary objective of this evaluation would be to assess the 
alignment of the program's priorities with the CBSA's priorities. The 


scope would also include a review of performance management 
indicators/results, training needs and coverage, data integrity 
(performance reporting, data entry and physical files, systems 
gaps), functional management model, roles and responsibilities of 
internal and external partners, program support, and development 
zx carman ation of pions to the re 

ct \ E. YT 
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program aligned with federal roles and responsibilities? 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress toward 
expected outcomes? 


The preliminary objective of this evaluation would be to determine 

if the CBSA has an adequate, effective and rigorous 

model/process to align resources with organizational priorities and 

objectives. The scope would also include a review the CBSA's 
itment, E TT training 
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This is a new program area that has never been evaluated. 
This program area is crucial to Agency resource development and a significant expenditure 
(5.9296 of total program spending). 


a 


Security 
Facilitation 
Organizational Culture 
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A | 
Relevance: Is there a continuing need for the programs? Are the This topic was initially identified as an audit in the 2016 Integrated Audit and Evaluation Plan. 
programs aligned to government and departmental priorities? Are Following consultations, it was deemed to merit an evaluation consulting engagement given the 
the programs aligned with federal roles and responsibilities? need to examine the results and the outcomes of the 31 integration. 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress toward 
expected outcomes? 


The preliminary objective of this consulting engagement would be 
to assess the effectiveness of the integration of the 3ls. The scope 
could include a review of performance management 
indicators/results, data integrity (performance reporting, data entry 
and physical files, systems gaps), functional management model, 
roles and responsibilities of internal and external partners, 
program support, and communication of program priorities to the 
regions. The engagement could also follow up on the findings of 
the 2014 Evaluation of the Intelligence Program and the 2015 
Evaluation of the Immigration Investigations Sub-Program. 


Salary: 2 FTE 
O&M: $3,000 3. Intelligence and Analysis 
Organizational Culture 
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— ls ‘the initia ive aligned 0 governmen and 
departmental priorities? Is the initiative aligned with federal roles 
and responsibilities? 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress toward 
expected outcomes? 


The preliminary objective of this evaluation would be to assess the 
alignment of the initiative's scope with the CBSA's priorities as per 
its Treasury Board submission commitment. The scope would also 
include a review of performance management indicators/results, 
training needs and coverage, data integrity (performance 
reporting, data entry and physical files, systems gaps), functional 
management model, roles and responsibilities of intemal and 
external partners, program support, and development and 

S uen no priorities to UE Teg 


Salary: 3 FTE 
O&M: $15,500 
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commitment. 
The initiative has a budget of $63.0 million and is still in progress. As of March 31, 2016, $43.5 
million had been spent. 


Intelligence and Analysis 
Facilitation 
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Hirn 


Relevance: Is there a continuing need fo prog mE This is a new progra 
program aligned to government and departmental priorities? Is the | e Risk of obsolescence of tools and technology and that programs outcomes may not be 
program aligned with federal roles and responsibilities? achieved. 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress toward 
expected outcomes? 


Given the specialized nature of this entity, the scope of the 
evaluation will be further developed in the planning phase; 
however, it is anticipated that the preliminary objective of this 
evaluation would be to assess the progress made against Ernst & 
Young review action plan and to examine the mandate, 
effectiveness and efficiency of the laboratory's operations (newly 
developed performance indicators as well as feedback from CBSA 
staff in the regions and operations would enhance the evidence 
collected on the results/contribution made by the laboratory). In 
particular, the evaluation could review the effectiveness of the 
maintenance of evidence, the security of facility and assets, and 
the impact on the Agency's results regarding the services provided 
to outside clients (RCMP, CRA, etc.), including finances and 
capacity. The scope could also include a review of its cost 
recovery model un lab supports other government departments 


Security 
Intelligence and Analysis 
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4.6 Consulting Engagements 


Consulting engagements harness the IAPED's expertise to better support the Agency in a less prescriptive, more responsive and 
business-driven way by providing a broader spectrum of products that meet management's needs and address key risks. These 
engagements may be performed at any stage, from the beginning to the end of a project (e.g., planning, research and reporting 
phases) or program (e.g., design, development and full implementation phases). They may also leverage the Agency's subject matter 
experts. Specific examples of consulting engagements can include the following: 


Review the relevance of the CBSA's involvement in programs 

Pre-implementation audits/evaluations (at the outset of programs) 

Advice on methodology (for programs performing their own internal reviews or monitoring) 
Review of efficiency proposals: did the Agency obtain the desired results? 

Data analytics 

Review of complex Memoranda to Cabinet or Treasury Board submissions 

Risk assessments 


NES D = 


The consulting engagements ultimately conducted by the IAPED will be decided upon in consultation with CBSA senior management 
and tabled at the AC and PMEC. 


4.7 Projects in Reserve 
In accordance with standards, the CAEE will review and adjust the plan, as necessary, in response to changes in the Agency's 
business, risks, operations, programs, systems, and controls. In some instances, a planned audit or evaluation may be postponed or 


cancelled by the AC or PMEC. Consequently, other projects may be advanced or other projects may be conducted due to an already 
complete schedule. The IAPED has compiled the following list of projects in reserve that may be conducted in such instances. 


Internal Audit Program Evaluation 
Human Resources Information Systems 
Poe eS 
Ce 
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5.0 RBAEP Summary 


5.1 Summary of Projects by Branch? 


The following graphics summarize the IAPED's planned activities expected to be completed over the audit and evaluation planning horizon, in addition to external audits and 
horizontals evaluations, by Branch. 


Graphic 2: Projects Endin J 


Projects Ending in 2017-2018 by Branch | Projects Ending in 2018-2019 by Branch 
internal audit * Program evaluation © External audit Horizental evaluation | internal audit © Program evaluation ^ External audit ^ Horizontal evaluation 
E 4 mE E 

CB 2 2 À 
3 2 
HRB | 2 i 
4 1 
| ISTB. | 2 
1 1 OB | 1 2 
à 3 4 3 PB | 1 x 2 
8 Only includes confirmed OAG projects up to 2018-2019. 
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Projects Ending in 2019-2020 by Branch | Projects Ending in 2020-2021 by Branch 


internal audit * Program evaluation External audit Horizontal evaluation | internal audit © Program evaluation ^ External audit ^ Horizontal evaluation 


CAB | | CAB 
CB | 1 | CB 
HRB | | HRB | 

ISTB | 2 2 | ISTB | 1 1 
OB | E | OB | 1 


PB 
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Projects Ending in 2021-2022 and 
Beyond by Branch 


internal audit © Program evaluation ^ External audit ^ Horizontal evaluation 


CAB 


| | Legend: 
ca bw CAB: Corporate Affairs Branch 
| | CB: Comptrollership Branch 
RRB 1$ | HRB: Human Resources Branch 
ISTR | | ISTB: Information, Science and Technology Branch 
| | OB: Operations Branch 
OB | | PB: Programs Branch 
PB E 8 a 
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5.2 Summary of Projects by Directorate? 


These graphics summarize the IAPED's planned activities expected to be completed over the audit and evaluation planning horizon, in addition to external audits and horizontals 
evaluations, by Directorate. 


.... Graphic 3: Projects Ending by Directorate and Fiscal Year 


Projects Ending in 2017-2018 by Projects Ending in 2018-2019 by 
Directorate Directorate 


internal audit © Program evaluation External audit ^ Horizontal evaluation , g D d . 
internal audit © Program evaluation © External audit © Horizontal evaluation 


CABS R 4 
CAB: CS 4 CB: AC 3 + 
CB: AC 4 4 CB: HEO 4 1 
CB: SPEO x CB: OCFORM x 
CB: iEO x 4 ISTB: ES 4 
ISTR: CPP 4 ISTB: AS * 
OB: IR y OBR 2 
OB: BO 4 OB: BO $ t 
HRB:TD 4 1 | HRB: LRC 5 
HRB: Programs T | HRB: Programs E 
PBICP C * 4 HRB: TD 4 
PE: ERI | 2 PB: E&I 2 
PB:TADP | 1 PB:TP 1 2 
PB:TP | a 1 1 PB: CP 1 
3 Only includes confirmed OAG projects up to 2018-2019. 
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Projects Ending in 2019-2020 by Projects Ending in 2020-2021 by 
: Directorate 
Directorate 
internal audit © Program evaluation External audit ^ Horizontal evaluation 
internal audit © Program evaluation External audit ^ Horizontal evaluation 
OB: IR 1 
CB: DCFORM $ 
ISTE: CPP * 1 ISTE: CPP | 1 
STB: SE X 
ISTB: EAMES E ISTB: BCPPM 4 
OB: TK a 
PREP 2 
PB: CP 4 
PB: TADP 4 PB: ERI 1 
PB: ES! a 1 
PB: TP a PB: TADP 4 
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Projects Ending in 2021-2022 by 
Directorate 


Legend: 
internal audit = Program evaluation © External audit © Horizontal evaluation AC: Agency Comptroller 


AS: Application Services 


i BO: Border Operations 
HRB: Programs jjj BCPPM: Business, Corporate Projects and Portfolio Management 
| CP: Commercial Program 
cao DUE CPP: Commercial Projects Portfolio 
CS: Corporate Secretariat 
PRES | 2 3 DCFORM: Deputy Chief Financial Officer and Resource Management 
E&l: Enforcement and Intelligence Programs 
TAM 4 1 ES: Enterprise Services 
| EAIMCS: Enterprise Architecture, Information Management & Common 
pace | 3 Services 
: IEO: Infrastructure and Environmental Operations 
—— —————Á IR: International Region 
LRC: Labour Relations and Compensation 
R: Recourse 
SE: Science and Engineering 
SPCO: Strategic Procurement and Contracting Operations 
TADP: Trade and Anti-Dumping Programs 
TD: Training and Development 
TP: Traveller Programs 
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5.3 Commitments 


This section lists the CBSA commitments stemming from external assurance providers, Memoranda to Cabinet or Treasury Board 
submissions, including for Beyond the Border initiatives that were included within the audit and evaluation schedules. 


Audit Schedule: 


1. eManifest will be tabled at AC in 2017-2018; 

2. Revenue Collection at the Border (Account Revenue Ledger (ARL) and Cash Management) will be tabled at AC in 2018-2019; 
3. 

4, 


Evaluation Schedule: 


Arming will be tabled at PMEC in 2017-2018; 

Interactive Advance Passenger Information will be tabled at PMEC in 2018-2019; 

Single Window Initiative will be tabled at PMEC in 2019-2020; and 

Entry/Exit and Radio Frequency Identification Technology will be tabled at PMEC in 2022-2023. 


STO D = 


6.0 Conclusion 


This Plan demonstrates the IAPED's continuing effort to provide the CBSA senior management with valuable audits and evaluations of the 
Agency's programs and initiatives. The timing of projects identified in the Plan reflects program risks, as well as priorities and issues identified 
through consultations with Agency senior management and IAPED employees. The IAPED will assess and revise the Plan annually in order 
to ensure that maximum oversight is achieved based on available resources and to consider senior management needs and commitments. 
Progress on the Plan’s implementation is reported quarterly to the AC and the PMEC for accountability purposes as well as part of the 
CBSA's oversight responsibilities. 
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Appendix A: Coverage of Enterprise Risks" 


This appendix presents the enterprise risk rating and the coverage offered by the projects identified in the 2017 RBAEP. 


Risk Rating and Coverage of Enterprise Risks (For Year 1 Internal Projects) 


Enterprise Risk Name 


Audit projects: 
e Advance Commercial Information System Data Quality 
Integrity — Air 


Evaluation projects: 
e 31 Integration 

e JAPI 

e Science and Engineering 


Evaluation projects: 
e Hearings 


Audit projects: 
e Advance Commercial Information System Data Quality 


Integrity — Air e Force Generation 
Border Controls over Marine Ports of Entry e 31 Integration 
e JAPI 
e Science and Engineering 


Audit projects: Evaluation projects: 
e Advance Commercial Information System Data Quality e JAPI 

Integrity — Air e Science and Engineering 
e Revenue Collection at the Border 


Trade Revenue Audit projects: 
e Revenue Collection at the Border 
e 


e Advance Commercial Information System Data Quality Integrity - Air 


Facilitation Audit projects: Evaluation projects: 

e Advance Commercial Information System Data Quality e Force Generation 
Integrity — Air e JAPI 

e Border Controls over Marine Ports of Entry 

Organizational Culture Audit projects: Evaluation projects: 
e | e Force Generation 
e Revenue Collection at the Border e 31 Integration 
LÀ 
e Occupational Health and Safety 
LÀ 


10 Based on the draft 2017 Enterprise Risk Profile. 
get 
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Appendix B: Detailed Schedule Information 


The schedule is the aggregation of all internal and external audits and evaluations planned over the next five years. The external and internal factors discussed in section 2 
contribute to an extensive list of 71 projects. Of these, 40 projects (56%) are in various stages of progress in the first year only. Audits and external engagements are not reflected in 
year four and five of the Plan since audit projects are identified on a three-year basis and because external stakeholders do not plan more than three years (sometimes two years in 
the case of the OAG) ahead. The evaluation function requires the identification of projects over a five-year period. 


In the following table, the start date for a project is typically the first month within the quarter identified, whereas the completion date is usually the last month within the last colored 
quarter. Details regarding scheduled AC and PMEC dates are provided at the bottom of the schedule. 


Office of Primary Interest Source of 2017-2018 2018-2019 2019-2020 2020-2021 2021-2022 


(Director General Level) Commitment 


# Type Planned Projects 
i Programs Branch: Enforcement and 
E H [National Anti-Drug Strategy (lead: Justice) Intelligence Policy on Results 


2 
o 


e 


National Action Plan to Combat Human Trafficking (lead: Public — |Programs Branch: Enforcement and Public Safety 
Safety) Intelligence Commitment 


H 
re Mane 


| EX [oustms Duties (lead: OAG, primary entity. CBSA) 12 


E Commercial Processing (Ar mode)" " 


M 
hais |: ss) - : ET 


Traveller Processing (Marine mode)” Programs Branch: Traveller Programs Policy on Results to 137 [PEC 
Recourse orporate Affairs Branch: Recourse Policy on Results 15 G77 [PEC 


Comptrollership Branch: Agency Policy on intemal 
|Compiroller |Audit oe z 
HR Branch: Training and Develo] 141 


pment NA 
Comptrollership Branch: Infrastructure and 
Environmental Operations pb o ES EX 
N/A 


EX CBSA Transactions iComptrollership Branch: Agency 
entity CBSA) Comptroller 


IA [Acquisition Card Program 


Comptrollershin Branch: Strategie Policy on Intemal 
Procurement and Contracting Operations {Audit 


Temporary Resident Biometrics Project and Immigration 
information Sharing: dead: immigration, Refugees and Programs Branch: Traveller Programs IRCC Commitment 
Citizenship)** 
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Office of Primary Interest Source of 20175 s 2017-2018 2018-2019 2019-2020 2020-2021 


E 
(Director General Level) Commitment M 


TBD 


# Type Planned Projects 


Operations Branch: International Region 

x Programs Branch Enforcement and $ 
Heanngs inislinenos Policy on Results 
Force Generation: HR Branch: Training and Development Policy on Results. 


A [Mahe Commercial information System Data Gualivintegriy- [IST Branch: Business Applications Policy on Intemal 
Air (T Audit) Services Audit 


p [Consulting Engagement- 3i Integration (Intelligence Collection |Programs Branch Enforcement and 
and Analysis, Criminal Investigations, Immigration Enforcement) [intelligence 


Policy on Results 


H International Mobility Program (lead: Immigration, Refugees and 


Citizenship) Programs Branch: Traveller Programs IRCC Commitment 


Policy on intemal 


Programs Branch: Commercial Programs Audit 


Comptrollership Branch: Agency 
Compeelercpendene Branch: Border — [TB Commitment 155.1 


Operations Branch: Border Operations External Engagement 


ves 


External Engagement 


Comptrollership Branch: Infrastructure and 
Environmental Operations 
px [CBSA Transactions and Financial Information (lead: OAG, primary |Comptrollership Branch: Agency 


entity CBSA) [Comptroller External Engagement 


Occupational Health and Safety 
Federal Contaminated Sites (lead: Environment and Climate Com Em lership Branch: Infrastructure and 


Change) Environmental Operations 
40 a [Electronic Travel Authorization (al A (lead: Immigration, Refugees |, crams Branch Traveller Programs [IRGC Commitment 14 N/A 
and Citizenship)’ 
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LÀ 


Office of Primary Interest Source of 
(Director General Level} Commitment 


2017-2018 2018-2019 2019-2020 2020-2021 2021-2022 


Planned Projects 


Š 


Coverage % 


| E [Science and Engineering IST Branch: Science and Engineering i L | |l] ES CTS puc S —| 


PT 
E [Consulting Engagement- To Be Determined* TBD ie mm 


ES 
* 


. Engagement 
B2 Refunds (Follow-Up Audit) i Xu 7 and Ant- "Policy on intemal 
IDumpng Programs - 


A 
a 


E 
a 


ES 
A 


Programs Branch: Traveller Programs 


Anti-Money Laundering and Anti-Terrorism Financing (AML/ATF) X |Programs Branch: Enforcement and 
Regime (lead; Finance) Intelligence 


A 
oa 


Policy on Results 


P 
o 


IST Branch: Commercial Portfolio / 
Programs Branch: Commercial Programs 


IST Branch: Commercial Portfolio / 
Programs Branch: Commercial Programs 


TB Commitment 


(0 
Window Initiative (Horizantal Evaluation) ** 


Policy on Results 


Programs Branch: Trade and Anti- 
Dumping Programs 

Programs Branch: Enforcement and IRCC Commitment 
Intelligence 

Security Screening [Operations Branch: international Region _| Policy on Results 
Commercial Facilitatoan and Compliance Programs Branch: Commercial Programs | |Folicy on Results 


Ko dd Benet infrastructure and |. 


Infrastructure and Materiel Policy on Resulis 
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Office of Primary Interest 
(Director General Level} 


Type Planned Projects 


Performance Management’ HR Branch: HR Programs 


Source of 
Commitment 


Policy on Results 


2018-2019 
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2019-2020 2020-2021 


D 
? B 


D 
A 


Crimes Against Humanity and War Crimes (lead: Justice) ee Enercon and 


Policy on Results 


Guns and Gangs (lead: Public Safety) Programs Branch enforcement and 


Public Safety 


Intelligence Commitment 


Trusted Trader"! Programs Branch: Commercial Programs 


Programs Branch: Enforcement and 
Intelligence 

Programs Branch: Commercial/Traveller 
Programs 


Folicy on Results 


Policy on Results 


Program Spending Coverage 


PL PRE 


Upcoming PMEC dates are as follows: Q1 - May 2017; Q2 - September 2017; Q3 - November 2017; Q4 - February 2018. Upcoming AC dates are as follows: Q1 - June 2017; Q2 - October 2017; Q3 - December 2017; Q4 - April 2018. 


* Program is not a one-to-one match with a program in the PAA. 


** Program includes a Beyond the Border initiative component, or is a stand-alone Beyond the Border initiative. 


IS = Internal Services 


N/A = The cost of this program is included within another larger program already accounted for in this plan or does not apply (i.e., internal audit, external engagement). 


PROTECTION « SERVICE - INTEGRITY 


Canada 


000048 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


| FINAL 
si Canada Border Agence des services PROTECTED A 


Services Agency frontaliers du Canada 


Appendix C: External Audit Engagements Schedule 


CBSA Office of Pri 
SA Office of Primary 2017- 2017-2018 2018-2019 2019-2020 
Interest Source of 2018 


(Director General Commitment PAA 
level) 


| Programs Branch: Trade and |Exernal 
|[Anti-Dumping Programs Engagement 


Planned External Audit Projects 


perations Branch: Border External 
perations Engagement 


omptrollership Branch: 


Infrastructure and EXEAT 


Engagement 


nvironmental Operations 
Comptrollership Branch: External 
Agency Comptroller Engagement 


7 | 
Isular Sermces [Operations Branch: 
International Region Engagement 
(lead: OAG c ! Operations Branch: Border  |External 
-  JOperations Engagement 


omptrollership Branch: Exémal 
nfrastructure and Endadement 
nvironmental Operations gag 


| omptrollership Branch: External 
"Agency Comptroller Engagement 


n 2 
SIAN NSA 
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Appendix D: Horizontal Evaluation Schedule 


CBSA Office of Primary 2017:  . 2017-2018 2018-2019 2019-2020 2020-2021 2021-2022 


Planned Horizontal Evaluation interest Source of 2018 


js Le (Director General level) - an LL PAA 


Programs Branch: Enforcement Policy on Results 
and Intelligence 

Programs Branch: Enforcement Public Safety 
and Intelligence Commitment 


Programs Branch: Traveller IRCC Commitment ES 
Programs 


à Pega Branch: Traveller IRCC Commitment 
rograms 
Comptrollership Branch: 
Infrastructure and Environmental — |Policy on Results 
i Operations 

Sm Programs Branch: Traveller pM 
Programs 

n . 

D me m passen EX pepe 
and Intelligence 

ge x 

o comm BBBBBE 

and Intelligence 
: Programs Branch: Enforcement Policy on Results 134 N/A 

and Intelligence 

Programs Branch: Enforcement Public Safety 
A 1.3.1 N/A 

and Intelligence Commitment 

Programs Branch: Enforcement t 
; Policy on Results 1.3.1 N/A 

and Intelligence 


** Program includes a Beyond the Border initiative component, or is a stand-alone Beyond the Border initiative. 
N/A = The cost of this program is included within another larger program already accounted for in this plan. 


N/A 
N/A 
N/A 
N/A 
N/A 


EES 
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Introduction 


This Risk-Based Audit and Evaluation Plan (RBAEP) outlines the 2019-2024 audit and 
evaluation activities for the Canada Border Services Agency (CBSA). It was prepared with an 
aim to maximize the value of the CBSAs internal audit and program evaluation functions. 


The RBAEP is a key requirement of both the Treasury Board Policy on Internal Audit and the 
Policy on Results. It was developed based on a structured methodology that included review of 
key documents; a risk assessment exercise of the Agency's Departmental Results Framework; 
consultations with Agency senior management and the external Audit Committee members; as 
well as consideration of the requirements of the Treasury Board Secretariat. 


The RBAEP is updated at least annually and presented each year to the CBSA Performance 
Measurement and Evaluation Committee and the Audit Committee for their review and 
recommendation for approval by the President. 


The internal audit and evaluation functions continue to work closely together as two important 
pillars of the Agency's oversight regime. The functions are mutually supportive, with important 
synergies between them, and yet are professionally distinct, with each uniquely adding value to 
the Agency. Collectively, these functions provide vital information to support management's 
oversight and decision making responsibilities. 
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Appendices 


Planning, Risk 
Assessment and 
Resources 


l. 
J. 


Contents 


Evaluation 
Schedule 


Internal Audit 
Schedule 


RBAEP Process, Inputs and Risk Assessment Approach 


Evaluation Coverage of Program Spending 


A. 
B 
C. Extemal Audit & Evaluation Schedules 
D. 
E 
F 
G 
H 


IAPED Suite of Services 


. Other Key Audit and Evaluation Activities 


summary of Projects by Branch 


. Oversight Universe 


. Internal Audit Project Profiles — Projects starting in 2019-20 


Evaluation Project Profiles — Projects starting in 2019-20 


Deputy Head Confirmation 
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Planning, Risk Assessment and 
Resources 
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CBSA Planning Context 


The CBSA provides integrated border services that support national security priorities and facilitate the 
flow of people and goods across the border. The Agency operates in a complex and dynamic 
environment where it must respond to emerging global trends and threats all while protecting 
Canada's people, economy and infrastructure. 


In response to increasing volumes of travellers and goods crossing the border, along with more 
complex security threats such as the opioid crisis, the CBSA has embarked on a series of renewal 
initiatives aimed at improving the Agency’s ability to assess and manage risk, while being more 
responsive to new threats and issues. 


The CBSA is also working towards ensuring that employees are effectively working together, sharing 
key information in a timely manner and taking advantage of opportunities to innovate. The Agency is 
making significant organizational changes to improve management structures and processes to better 
align program management activities with the Departmental Results Framework (DRF). The Agency is 
also advancing efforts at all levels to encourage a healthy workplace and a high-functioning 
organizational culture. 


IAPED's risk assessment took into consideration the significant changes being brought about by the 
renewal agenda. The high risk areas identified, along with program-specific risks, are presented on the 
following slides. 
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List of High Risk Areas Identified by IAPED 


Transformation / 
Change Management 


- Risk that culture change may not be able to keep pace with the transformation (too much change at the same time), in 
particular if additional funding is received 


- Risk that the CBSA may not be able to continue delivering on its core business as it undergoes significant change 


Management and - Risk that internal services may not have adea capacity to support the Agency s Renewal initiatives 
Delivery Support 


People Management - Risk that the CBSA may not be able to attract and retain employees in critical skillset categories 


- Risk that the CBSA's culture may not support a healthy and productive workplace where employees feel they can raise 
concerns and that the appropriate action will be taken 
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List of High Program Risks 


(based on IAPED's risk methodology) 


Detentions and 
Removals 


Traveller (Highway 

and Air) increased traveller volume, new processes and technology 

Commercial & Trade 

- Compliance 

Field Technology - Risk that the CBSA may not be able to adequately fund, support, maintain and provide training on field 
Support technology to meet its core service delivery obligations 


Compensation - Risk that processes and controls may not be operating effectively therefore increasing pay errors. 


- Risk that current challenges caused by Phoenix and lack of timely updates to the CAS system may result in 
greater inaccuracy in payments to employees 
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IAPED Resources 


The RBAEP has been designed with the objective of allocating resources to the areas of 
highest significance, while ensuring evaluation coverage of the Agency’s DRF. The tables 
below provide breakdowns of IAPED's planned full-time equivalents (FTEs) and budget. 


2019-20 IAPED Planned FTEs by Division 


Director Internal alluit Program Professional 

General's L.. Evaluation Practices Total FTEs 
CEN Division m. m. 

Office | | . Division Division | | 

$ | 23. 15 15 59 


2019-20 IAPED — by Division 


Director General's Internal Audit Program 
fice" Division Evaluation Divisio 


$598,894 $175,872 $1,746,297 $402,332 $1,212,028 $187,681 $1,407,144 $173,268 $4,964,363 | $5,903,516 


*Includes the Senior Officer for Internal Disclosure (SOID) 
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Internal Audit Schedule 
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à 


Internal Audit Schedule 


Audit of Revenue Collected by the CBSA FCMB 


Audit of Occupational Health and 
Safety (OHS) 


PROTECTION + SERVICE + INTEGRITY 
* Engagement stemming from a previous commitment. 


Note: We anticipate adding two projects to table at AC 1200060 4 


Internal Audit Schedule (cont’d) 


í 


| 
i 
| 
f 


a 
: 


f 
: 


[an 
E 
B. 
go 
[98 
u^ 
m. 
G 
pe 
m 
= 
Q 
m 


* INTEGRITY 


000061 


* Engagement stemming from a previous commitment. 


Evaluation Schedule 


PROTECTION « SERVICE + INTEGRITY 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Evaluation Schedule 


| 2020-2021 - 2 


Study- Postal Operations Commercial & 
(Modernization) Trade 
Field Technology Support 
(Previously Science and ISTB 
Engineering) 
Commercial Facilitation and Comm 

P e 


Traveller Facilitation and 
Compliance 

Study - CBSA Assessment and 
Revenue Management 
(CARM) 

Study (follow-up) - Primary 
Inspection Kiosks 


"Travellers 


Travellers 


Buildings and Equipment 
(Previously Infrastructure and FCMB 
Materiel) 


PMEC Year 5 
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Evaluation Schedule (cont'd) 


ice & 


"Travellers | 


Intelligence & 


Enforcement 
Enforcement 
Enforcement 
Intelligence & 
Enforcement 


Intelli 


Information (APE) 


Opioid interdiction is a topic being considered for a future evaluation study; timing and iud to be determined. 


in a Treasury Board submission. 


* An evaluation of the Duties Relief Program/Duty Drawback Program is expected to be added to the evaluation plan to fulfil a recent commitment 


Projects in reserve: 


Study - Functional 
Immigration Investigations 
Criminal Investigations 


Management Model 


Interactive Advance 
Force Generation 


Targeting 


Appendices 


RBAEP Process, Inputs and Risk Assessment Approach 
Evaluation Coverage of Program Spending 

External Audit & Evaluation Schedules 

IAPED Suite of Services 

Other Key Audit and Evaluation Activities 

Summary of Projects by Branch 

Oversight Universe 

Internal Audit Project Profiles — Projects starting in 2019-20 
Evaluation Project Profiles — Projects starting in 2019-20 


Deputy Head Confirmation 
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M. 


2019 RBAEP Process 


Validation and 
Reporting Phase 
(Dec 2018 — Jan 2019) 


1. Send launch email 1 Interview selected DGson 1. Draft audit and 1. Present RBAEP to 
2. Confirm oversight risks evaluation schedules PMEC (Feb 2019) 
universe 2. Document review 2. Validate audit and 2. Present RBAEP to AC 
3. Assess risks evaluation schedules (Mar 2019) 
4. Consult on projects and with senior management 3. Obtain President’s 
schedule and Audit Committee approval 
5. Consult Audit Committee (AC) 
on risk 3. Finalize audit and 


evaluation schedules 
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Key Inputs into the RBAEP 


enior management consult 
s, and Branch Liaison 


es and potential |A engagements 
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IAPED's 2019 Risk Assessment Approach 


Step 1: Update CBSA Oversight Universe 
> Closer alignment of oversight universe elements with the DRF and Agency activities. 


Step 2: Document review and targeted interviews 
» Document review led to an inventory of over 350 risk statements. 
» Interviews focussed on DGs who were not consulted for the previous RBAEP. 


Step 3: Risk assessment 
> Risk factors expanded to more explicitly include Agency priorities /initiatives, as well 
as to take into consideration the IAPED’s recent internal controls gap analysis. 
> Risk factor weighting adjusted to better balance Agency priorities /initiatives, 
materiality, risks identified in document review, as well as historical audit and 
evaluation coverage. 
> Deeper analysis performed on priority areas to identify and scope potential projects. 


Step 4: Validation 
» Risks validated and feedback sought from CBSA senior management and Audit 
Committee. 
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Evaluation Coverage of Program Spending i 


The TB Požcy on Results requires that all program spending be evaluated periodically; 
however, departments have the flexibility to plan their evaluations based on need, risk 
and priority. 


The 2019 evaluation plan covers approximately 94% of direct program spending over 
the five year planning horizon (based on 2018-19 figures). 


Two programs are not included in the 2019 plan, mainly because of the recently 
launched OAG Audit of Immigration Detentions and Removals 


1. Detentions 
e Last evaluated in 2011 
* Internal Audit conducted a Review of Detention Determinations in 2018 
2. Removals 
e Components of the Removals program were last evaluated in 2015 (Assisted 
Voluntary Return and Reintegration Pilot) 


Evaluations of the Detentions and Removals programs will be considered as we prepare 
the 2020 evaluation plan, taking into consideration areas covered by the OAG. 
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External Audit Schedule 


In-Canada Asylum Process (lead: OAG, pimay entities: IRCC and 
CBSA) 
Horizontal Audit on Credential Validation (ead: PSC) 


‘Taxation of Cross-Border E-Commerce s OAG, pamary entity: 
CBSA) 
Respectful Workplaces (lead: OAG, piman e entities: CBSA and 


AG, primary entity: CBSA) 


Immigration Detention and Removal dead: © OAG, primary entity: 
CBSA) 

Procurement of IT Services (lead: OAG, primary entity: oo 
departments) 
Government-Wide Departmental Progress in iadi 
Sustainable Development Strategies (lead: DAC: ee Er 
multiple departments) 


Consideration of internal and external planned engagements: 


CBSA - Released under the Access to Information Act. 
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As part of its planning exercise, the LAPED considered the work of internal assurance providers such as the Comptrollership Branch’s Internal 
Control Review Plan and the plans of external assurance providers such as the Office of the Comptroller General (OCG) and the Office of the 
Auditor General (OAG) to avoid duplication. In addition, the IAPED considered planned horizontal evaluations across government as part of 


its coverage and burden calculations. 
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ormation 


Sharing Initiative (lead: Immigration, 


Schedule of Horizontal Evaluati 
Refugees and Ciüzenship) 


Citizenship Program (lead: Immigration, 


Refugees and Citizenship) 
Immigration and Refugee Protection Act 


iometrics and Immigration 
Division 9/National Security 


Inadmissibility (lead: Public Safety) 
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The Canadian Drugs and Substances 
Passenger Protect Program (lead: Public 
Guns and Gangs (lead: Public Safety) 


Strategy (Lead: Health Canada) 
Asylum Program (lead: Immigration, 


Refugees and Citizenship) 


Cannabis (lead: Health Canada) 


Provides independent, Provides in-depth testing 
objective assurance on of selected key controls. 
governance, controls 


and risks. 


12 months 


Narrow scope to allow 
for timely reporting and 


corrective action. 


3 to 6 months 


Formal report. Flexible reporting (i.e. 
Presented at AC. deck or report). 
Approved by the Presented at AC. 


President. 


Published 


Approved by the 
President. 


Published 


D Suite of Services Interna 


Provides broad or targeted 
information, with less 


depth and coverage. 


Some reviews are the result 
of an audit being 
downgraded due to 
insufficient controls to 
perform testing. 


6 to 9 months 


Flexible reporting (i.e. deck 
or report). 

Presented at AC. 
Approved by the 

President. 


Not published 
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Requested by management, 
who plays a role in defining 
the objectives and scope of 
the engagement. 


3 to 6 months 


Flexible reporting (i.e. deck 
ot report). Significant 
consulting engagements 
will be tabled at AC. 


Not published 
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uite of Services Program 


P a ion 


Program evaluation is the systematic and neutral Provides objective, timely and reliable insights on 
collection and analysis of evidence to judge merit, significant or emerging questions using the rigour of 
worth or value. It typically focuses on programs, evaluation methodology (e.g. surveys, benchmarking, 
policies and priorities and examine questions time-motion studies, etc.). 

related to relevance, effectiveness and efficiency. 


‘They are scoped in consultation with management 
Scope is defined via a formal planning phase that and provide valuable information for decision-making 
includes LAPED’s recommendation, Evaluation purposes. | 
Advisory Committee (ZAC) endorsement, and 

PMEC’s approval. 


10 to 12 months < 9 months 
Formal report. Flexible reporting (i.e. deck or report) 
Presented at PMEC. 
Apptoved by the President. 
Published Not published 
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Other Key Audit and Evaluation Activities 


Tracking and quarterly reporting to the Executive Committee, the Audit Committee and 
Performance Measurement and Evaluation Committee on the status of CBSA management action 
plans resulting from audit and evaluation recommendations. 


Liaison services to support CBSA management in their interactions with external assurance 
providers such as the Office of the Auditor General (OAG). Includes the review of reports and other 
documents received from external assurance providers, as well as supporting management in 
responding and preparing action plans for external audit recommendations. 


Supporting the Chief Audit and Evaluation Executive in carrying out their responsibilities to review 
and approve Treasury Board submissions and Memoranda to Cabinet. 


Managing horizontal evaluations involving the CBSA with an aim to foster effective working 
relationships with other federal departments, as well as to ensure that the Agency is reflected in a 
fair and accurate manner in all horizontal evaluation reports. 


IAPED's quality assurance and improvement program is designed to support the demonstration of 
conformance with the Treasury Board Policy on Internal Audit and the Policy on Results. The 
program also assesses the efficiency and effectiveness of IAPED's activities and identifies 
opportunities for improvement. 
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Summary of Projects by Branch 


The tables below summarize the IAPED's planned activities, as well as external audits and horizontals evaluations, by branch over the first two years of the RBAEP. 


n 2019-20 by Branch 


Projects Ending“ i 


COMMERCIAL & TRADE 
TRAVELLERS 
INTELLIGENCE & ENFORCEMENT LLL LLL 


= Internal Audit 


» Evaluation 


COMMERCIAL & TRADE 
TRAVELLERS 

INTELLIGENCE & ENFORCEMENT 
SPB 

ISTB 

HRB 

FCMB 

CTO 

CARM 


» Internal Audit 

if Evaluation 

if External Audit 

* Horizontal Evaluation 
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* For CBSA-led projects, “ending” refers to the AC or PMEC tabling date ANIS 


Oversight Universe 


The oversight universe defines the potential scope of internal audit and 


evaluation activities and is comprised of entities that may be subjected to them 
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Immigration Investigations 


Warrant Management 


Detentions 


oN 


ES 
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* Hearings 


Criminal Investigations 
-Digital Forensic Analysis 


Removals 
Surveillance 


ES 
EN — 
B 


= 
ES 
x 


x a 


26 


TY 


ON * SERVICE « INTEGRI 


i 


PROTECT 


000076 


CBSA - Released under the Access to Information Act. 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information 


Oversight Universe 


Au it Universe Elements 


* Targeting - Air Cargo/Postal * Targeting - * Targeting - Data Analytics 


* Targeting - Travellers (NTC) Rules/Indicators/ * Targeting - Intelligence 
Scenarios 
* |ntelligence Operations * Confidential Human * |nternational Programs, Operations 
* Surveillance Sources and Partnerships 
* National Security Screening 
* Traveller - Highway * Traveller- Rail * Traveller- Border Operations 
* Traveller - Air * Traveller- Marine Centre 
* Commercial - Highway * Trade - Export * Trade - B2s 
* Commercial - Air * Trade - Assessment & * Trade - Compliance Verification 
* Commercial - Rail Revenue * Trade - Licensing & Incentives 
* Commercial - Marine 
* Commercial - Postal 
Trusted Traveller e Trusted Traveller 
[ [ * Trusted Trader 
i-dumpi D * Anti-dumping and Countervailing 
+ Recourse 
. BSO Training | * Detector Dogs . BSO Recruitment 


* Buildings and Equipment- Real * Uniform Program 
Property 


| * Field Technology Support 
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Oversight Universe 


INTERNAL SERVICES 
Program Inventory | Audit Universe Elements | : : 
Policy, Planning and Government Relations * Corporate Reporting 
* |nvestment Planning * Audit & Evaluation 
* Enterprise Risk Management and Controls * ATIP 


* Communication Services 
* Litigation Management Oversight 


* HR Planning and Reporting e HR Training and Learning 
¢ HR Classification e HR Labour Relations 

* HR Staffing * HR Systems 

* HR Compensation * HR Executive Services _ 


* Financial Planning and Budgeting 
* Financial Accounting and Reporting 
* Financial Internal Controls 


* Information Management and Entreprise 
Architecture 
e Privacy 


* IT - Computing & Access * IT - Security 

IT - Application/Database Development and * |T - Operations and 
Maintenance Services 

* IT - Telecommunications 
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Internal Audit Project Profiles — Projects starting in 2019-20 
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modernize and improve cross-border commercial being achieved? 

processes by requiring carriers, freight forwarders and Performance (Efficiency and Economy): How are 
importers in all modes of transportation (air, marine, resources utilized in relation to the production of outputs 
highway and rail) to electronically transmit advance and progress toward expected outcomes? 

commercial information to the CBSA prior to the 

artival of commercial goods at the border. The evaluation study could examine questions related to the 
This initiative was evaluated in 2012 and auditedin © to which benefits are being realized as expected, 
2018. including the impact of scope changes, the impact on risk 
assessment, and the ability of resources to focus on value- 
added activities. The study could measure the progress, 
benefits and the achievement of business outcomes related 
to the deployment of key new applications such as the 
There is a risk that the Agency may not fully realize the Passage System (replacing a portion of ACROSS) and the 
benefits identified at the onset of the project given the Commercial Threat Assessment System (C TAS) replacing 
changes to its originally defined scope (ie. de-scoping the current ITIAN system. 

of electronic tisk assessment of crew, re-manifest 

information and deferral of rollout of passage). 


There is a tisk that the eManifest initiative outcomes 
may not be achieved and that the benefits associated 
with its implementation may not be realized. 


- HE " | c wm | II - a mE Sex} mr _ 
O&M: $20,000 Compliance : Project Management 
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valuation Project Profiles — Projects starting in 2019-20 


t 


ecurity Screening supports the identification an 
interception of people trying to enter the country as 
permanent or temporary residents, or asylum seekers. 


The automation of security screening functions is 
expected to contribute to an overall enhancement of 


analytical capabilities. 


‘There is a risk that the CBSA may not be able to access, 
manage, and communicate timely and actionable 
information that lead to an enforcement action or 
inadmissibility recommendation. 


There is a risk that the CBSA may not be able to leverage 
advanced analytics to identify high-risk people. 


Security Screening 


S 


program aligned to government and Agency priorities? Is the 
program aligned with federal roles and responsibilities? 


Performance (Effectiveness): Are expected outcomes being 
achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress 
toward expected outcomes? 


The evaluation could examine questions related to the extent to 
which threats identified lead to an enforcement action or 
inadmissibility recommendation, as well as efficiency gains and 
other enhancements brought about by the automation of 
functions. 


The evaluation could review identified threats, inadmissibility 
determinations, cost per application, as well as service standards 
and coordination with other government departments. Focus 
could be on temporary and permanent residence applications, to 
avoid overlap with the current OAG audit of In-Canada Asylum 
Seekers, and the 2017 Audit of Operation Syrian Refugee (OSR) 
— CBSA Security Screening. 
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The CBSA administers trade legislation, trade agreements 
and regulations to ensure that duties and taxes owed to the 
Government of Canada are collected. 


‘To facilitate the high volumes of trade, the CBSA relies on 
importers to voluntarily report and account for goods 
imported into Canada and any duties or taxes owing. To 
assess compliance levels the CBSA regularly conducts 
random verifications on a sample of imported goods. 


Revenue and Trade Management Program (Trade 
Compliance) was last evaluated in 2013. 


There is a risk that the CBSA’s business processes for B2 
refunds (i.e. accounting adjustments after duties and taxes 
have been paid) may not efficiently meet increasing 
volumes. 


‘There is a risk that the sampling methodology of post- 
payment refunds may be inadequately designed or 
inconsistently applied. 


Commercial Trade Facilitation and | 
Compliance 
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Evaluation Project Profiles — Projects starting in 2019-20 


Relevance: Is there a continuing need for the program? Is the 
program aligned to government and Agency priorities? Is the 
program aligned with federal roles and responsibilities? 


Performance (Effectiveness): Are expected outcomes being 
achieved? 


Performance (Efficiency and Economy): How are resources 
utilized in relation to the production of outputs and progress 
toward expected outcomes? 


The evaluation could examine questions related to the extent to 
which importers correctly report and account for imported 
goods, as well as the extent to which other objectives are being 
met. An assessment of CARM could be scoped out as this will be 
the focus of a dedicated evaluation study. The focus could be on 
the loss of revenue due to misclassifications, efficiency of the 
Agency’s self-assessment system, level of reliance on importers’ 
information and supporting documentation, and effectiveness of 
Administrative Monetary Penalties, taking into account the 2017 
OAG findings on Customs Duties. 
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Evaluation Project Profiles — es starting in 2019-20 


kd q P 8 
while the CBSA is expected to interdict travellers and their 
goods that could pose à threat to the security and safety of 
Canadians. 


There is a risk that automated processes lack the enhancements 
required to facilitate the border movement of low-risk travellers 
and goods, while ensuring that the CBSA continues to receive 
information required for the risk assessment of travellers. 


There is a risk that increasing traveller volumes will impede the 
CBSA’s ability to effectively conduct enforcement activities 


There is a risk that Advance Passenger Information is not 
accurate and thus impeding the overall effectiveness of pre- 
arrival air traveller risk assessment. 


Traveller Facilitation and Compliance 


aligned to government and Agency priorities? Is the program aligned 
with federal roles and responsibilities? 


Performance (Effectiveness): Are expected outcomes being 
achieved? 


Performance (Efficiency and Economy): How ate resources utilized 
in telation to the production of outputs and progress toward expected 
outcomes? 


The evaluation could examine questions related to the extent to which 
current border clearance processes efficiently and effectively facilitate 
low-risk travellers while addressing security risks. The focus could be 
on ait and highway modes to avoid overlap with the 2017 Evaluation 
of Traveller Processing (Marine). The evaluation could review the 
effectiveness of pre-arrival air traveller risk assessment, the validation 
and accuracy of data collected at primary examination, as well as 
referrals to the secondary examination atea and the scanning of 
documents through the Integrated Primary Inspection Line system. 
Focus could be on overall effectiveness of automated processes and 
business models, taking into consideration the 2018 study of Primary 
Inspection Kiosks. 


"Traveller (Highway and Air) 
Management and Delivery Support 
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Deputy Head Confirmation 


| hereby approve the CBSAs 2019 Risk-Based Audit Plan and Five-Year Evaluation Plan for the fiscal 
years 2019-2024, which | submit to the Treasury Board of Canada Secretariat (TBS) as required by the TB 
Policy on Internal Audit and the TB Policy on Results. 


The 2019 Risk-Based Audit and Evaluation Plan conforms to applicable Government of Canada 
requirements, including: 

* The Policy on Internal Audit and the Mandatory Procedures for Internal Auditing in the Government of Canada 
as well as applicable guidance for risk-based audit planning put forth by the Office of the Comptroller General; 
and 

* The Policy on Results and the Mandatory Procedures for Evaluation. This five-year Evaluation Plan supports 
the requirements of the expenditure management system including, as applicable, Memoranda to Cabinet, 
Treasury Board submissions, and resource alignment reviews. The CBSA does not administer grants and 
contributions programs. 


| will ensure that this plan is updated annually, and | will provide information about its planning and 
implementation to the TBS, as required. 


Date : April 10, 2019 


John Ossowski, CBSA President 
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Program Evaluation 
Directorate 


Agence des services 
Services Agency frontaliers du Canada 
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Message from the Chief Audit and Evaluation Executive 


As the Canada Border Services Agency’s (CBSA) internal audit and program evaluation functions both report to the Chief Audit and 
Evaluation Executive, the Internal Audit and Program Evaluation Directorate continues to take advantage of this synergic opportunity to 
integrate the two functions within its planning exercise activities. The integration efforts provide the Agency with highly valued insight as part 
of its oversight continuum. 


As part of our continued integration effort, | present you our fourth iteration of the plan, the CBSA’s 2018 Risk-Based Audit and Evaluation 
Plan. The audit and evaluation projects identified in this document respond to the requirements, priorities and risks of senior management 
and meet the legislative and compliance requirements of the Govemment of Canada. 


Claudette Blair 
Chief Audit and Evaluation Executive 
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Deputy Head Confirmation 


| hereby approve the CBSA's fourth integrated Risk-Based Audit Plan and Five-Year Program Evaluation Plan for the 2018-2023 audit and 
evaluation activities, which | submit to the Treasury Board of Canada Secretariat (TBS) as required by the Policy on Internal Audit and the 


Policy on Results. 


The 2018 Risk-Based Audit and Evaluation Plan conforms to applicable Government of Canada requirements, including: 


e The Policy on Internal Audit and the Mandatory Procedures for Intemal Auditing in the Government of Canada contained therein and 
the supporting guidance for risk-based audit planning put forth by the Office of the Comptroller General; and 

e The Policy on Results: this Departmental Evaluation Plan meets the requirements of the Mandatory Procedures for Evaluation and 
supports the requirements of the expenditure management system including, as applicable, Memoranda to Cabinet, Treasury Board 
submissions, and resource alignment reviews. The CBSA does not administer grants and contributions programs. 


The CBSA is committed to remaining innovative and to improving its overall relevance, performance, risk management, govemance and 
controls. As such, the approach taken to develop and implement this document is in line with our modernization efforts. 


| will ensure that this plan is updated annually, and | will provide information about its planning and implementation to TBS, as required. 


Date : 


John Ossowski 
President 
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1.0 Introduction 
1.1 Background 


This Risk-Based Audit and Evaluation Plan (RBAEP or the Plan) outlines the 2018-2023 audit and evaluation activities for the Canada 
Border Services Agency (CBSA or the Agency). The Plan provides background information on the Agency's Internal Audit and Program 
Evaluation Directorate (IAPED). It also describes the overall context and methodology used in its development and presents the proposed 
internal and extemal audit and evaluation activities approved for future years. 


A departmental Risk-Based Audit Plan (RBAP) and a Five-Year Program Evaluation Plan (FYPEP) are both required under the Policy on 
Internal Audit and the Policy on Results, respectively. For a fourth consecutive year, an integrated approach has been taken to ensure that 
audit and evaluation products and services are optimally aligned and of greatest benefit to the CBSA. 


The Plan was developed based on a structured methodology such as the review of key documents; a risk assessment exercise of the 
Agency's activities under the draft 2018-2019 Departmental Results Framework (DRF); consultations with Agency senior management and 
the external Audit Committee (AC) members; as well as consideration of the requirements of the Treasury Board Secretariat (TBS). It has 
been designed to ensure appropriate coverage of the Agency's risks and the DRF. It is updated and presented each year to the CBSA 
Performance Measurement and Evaluation Committee (PMEC) and the AC for their review and recommendation for approval by the 
President, in advance of its required submission to TBS. 


1.1.1 Overview of the IAPED' 


The IAPED's mission is to foster management excellence, performance, and accountability through the provision of professional insight 
and advice. To this end, the IAPED's vision is to be a key, valued and sought-after partner and contributor to the Agency's strategic and 
management decision making and an active player in support of the Agency's oversight regime, supporting its continuous modernization. It 
acts as an educator and an enabler to the CBSA by providing not only an insightful perspective but also punctual advice to senior 
management for enhanced and timely decision making. 


For that reason, the IAPED's goal is to be a valued contributor that provides assurance to the Minister, President and senior management 
on the organization's control framework, governance, risks, relevance, and performance of the Agency's programs and activities. 


The internal audit and evaluation functions will continue to work closely together as two important pillars of the Agency's oversight regime. 
The functions are mutually supportive, with important synergies between them, and yet are professionally distinct, with each uniquely 
contributing value to the Agency. The table below outlines some of the contributions made by each function. Taken collectively, each 
function provides vital information in support of management's oversight and decision making responsibilities. 


1 All of the IAPED’s key initiatives and resources are detailed in its Integrated Business Plan. 
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Overall 
purpose 


What is 
examined? 


Overall 
questions 


Table 1: Key Contributions and Synergies of the Audit and Evaluation Functions 


“internal auditing is an independent, 
objective assurance activity designed to 
add value and improve an organization's 
operations. It helps an organization 
accomplish its objectives by bringing a 
systematic, disciplined approach to 
assess and improve the effectiveness of 
risk management, control, and 
governance processes.” 

-International Standards for the 
Professional Practice of Internal Auditing 


Risk management 
Control 
Governance processes 


Are the governance, risk management 
and control systems designed 
appropriately and adequately to 
mitigate risk and to respond efficiently 
and effectively to management's 
needs? 

Are the practices implemented in the 
areas of governance, risk 
management and control working as 
intended to support the achievement 
of objectives? 


Evaluation 


“In the Government of Canada, 
evaluation is the systematic and neutral 
collection and analysis of evidence to 
judge merit, worth or value. Evaluation 
informs decision making, improvements, 
innovation and accountability. 
Evaluations typically focus on programs, 
policies and priorities and examine 
questions related to relevance, 
effectiveness and efficiency. Depending 
on user needs, however, evaluations 
can also examine other units, themes 
and issues including alternatives to 
existing interventions. Evaluations 
generally employ social science 
research methods.” 

-Treasury Board Policy on Results 


e Relevance 
e Effectiveness 
o Outcomes 
Efficiency 
o (Inputs 
o Outputs 


ls there an ongoing need for the 
program? 

Does it align with government 
priorities? 

Does it align with federal roles and 
responsibilities? 

Is it achieving its expected (or 
intended) outcomes? 

Does the program demonstrate 
efficiency and economy? 


Value of Synergies 


Together, the two 
functions provide 
credible, independent 
and neutral advice to 
inform decision making. 
The work done by one 
function positively 
influences the business 
intelligence for the other 
and plays a role in 
defining a scope. 


By focusing on different 
questions, both functions 
can strengthen overall 
program management 
operations whether they 
are examining programs, 
policies or internal 
services. 


The internal audit and evaluation functions offer a range of services including audits, evaluations, targeted control audits, reviews, 
evaluation studies, and consulting engagements. Appendix E provides a summary of each type of engagement, expected timelines, and 
the reporting and publication implications. 


1.1.2 Tables of Planned Resources? 


? As of April 19, 2018. 
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The Plan has been designed with the objective of allocating resources to the areas of highest significance, while ensuring judicious 
evaluation coverage of the Agency's DRF. Table 2 provides a breakdown of the full-time equivalent (FTE) positions by division and the 
Director General's Office, while Table 3 outlines the financial budget for 2018-2019. The $5.05 million allocated for salary allows for all of 


the 56 positions to be fully staffed. 
Table 2: 2018-2019 IAPED FTE Positions by Division 


Director General's "T Program Evaluation _ Professional 
Office Internal Audit Division Division Practices Division Total FTEs 


Table 3: 2018-2019 IAPED Budget by Divisi 
D 


Program Evaluation [p 
Division [ 
| O&M Salary | O8M Sala | O&M 
y y 
$1,233,759 | $201,856 | $1,432,372 | $186,355 | $5,053,369 | $1,010,086 | $6,063,455 


Director General's 
Office 


Salary O&M Salary 


Total Total Total 


Internal Audit Division 
Salary O&M Budget 


$609,032 | $189,155 | $1,777,606 | $432,720 


1.1.3 Structure 


The 2018 RBAEP outlines, in an integrated manner, the schedule for the priority engagements related to the audit function from 2018-2019 
to 2020-2021, including external engagements managed by the Professional Practices Division (PPD). It also outlines the evaluation 
schedule to cover the Agency's direct program spending from 2018-2019 to 2022-2023, including horizontal evaluations also managed by 


the PPD. 


3 Includes two FTEs from the Senior Officer for Internal Disclosure (SOID), a function that provides employees with a confidential mechanism to report 
wrongdoing, outside of the chain of command, as well as protection from reprisal when they do so. 
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2.0 Methodology 


The IAPED has made improvements with regard to the development of its 2018 Plan. The audit universe was revised to a more granular 
level which allowed for a more detailed risk assessment that resulted in more targeted audit and evaluation projects. The risk assessment 
process included a two-tiered risk approach, to allow for deeper understanding of risk areas and to consider maturity of areas and the 
existence of second line of defense activities (i.e. monitoring activities, quality assurance reviews). In addition, a risk inventory was 
developed based on consultations with senior management and reviews of key Agency documents. Finally, an IT risk assessment was 
conducted to ensure a higher level of focus on IT risks. The validation of the selected projects was conducted through the consultations 
process with branch management tables as well as a discussion with the AC members to ensure that the Plan addresses the most 
significant risks to the CBSA. Beyond traditional audit and evaluation reports, the IAPED will continue to offer consulting engagements to 
the Agency in an effort to provide additional advice that is valuable and timely. 


The following key steps were taken to develop the Plan: 
2.1 Step 1: Review of the IAPED Oversight Universe 


The oversight universe defines the potential scope of internal audit and evaluation activities and is comprised of entities that may be 
subjected to them. These areas represent a holistic view of all potential auditable and evaluable units, such as program areas, functions, 
structures, funded initiatives or internal services that collectively contribute to the achievement of the Agency's strategic outcome. For the 
CBSA, this year's oversight universe was based on the Agency's activities, which were categorized into audit universe elements, and 
aligned with the Departmental Results Framework (DRF) (Appendix G). This Plan used the 2018-2019 Agency DRF to develop the 
schedules (Appendix B). 


2.2 Step 2: Mapping of Previous Coverage 


To guide the selection of audit and evaluation projects as part of the Plan, the IAPED continuously updates the previous work that has 
been completed and areas within the Agency that have already been covered by the IAPED's oversight. As such, the mapping of previous 
audits and evaluations completed in the last five fiscal years was updated, including external activities. This exercise contributed to 
understanding of what has already been accomplished in previous years and the type of issues highlighted by these projects, which helped 
the selection of future projects based on our past activities. 


2.3 Step 3: Risk Assessment and Identification of Potential Projects 


While audit projects identified typically focus on high-risk areas, evaluation projects continue to focus on coverage of the DRF, although the 
Policy on Results does allow for some flexibility. The projects were identified by accomplishing the following steps: 


1. Review of key CBSA documents: A review of Agency information included the Enterprise Risk Profile (ERP), Branch Risk Profiles, the 
Agency's Departmental Security Plan, the CBSA Departmental Plan, the 2018-2019 DRF, the CBSA Environmental Scan, the 
Management Accountability Framework results, the Agency Performance Summary report and other key presentations was 
conducted. The document reviews contributed to the risk inventory that was developed. 


2. Risk assessment exercise: A two-tiered risk assessment exercise was conducted in order to assess the oversight universe for intemal 
audit. The first tier (Tier 1) involved mapping the assurance history against the universe and included internal and external audits, 
evaluations, reviews and consulting engagements. The second factor was materiality which included both financial and Full-Time 
Equivalent (FTE) information. The third factor assessed as part of the Tier 1 was the risk inventory. The risk inventory, as described 
above, was developed based on key risks identified through the review of key CBSA documents and through discussions on risk with 
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senior management from all branches. Based on these three factors, the oversight universe was risk ranked. The top 25 audit universe 
elements proceeded to the Tier 2 risk assessment. 


The Tier 2 risk assessment involved a qualitative assessment of oversight universe elements and included analysis of: 
e Historical audit and evaluation key findings and recommendations; 
Outstanding Management Action Plan items resulting from these recommendations; 
Maturity of the activity or program area; 
Planned Internal Control testing or coverage; 
Existing ongoing monitoring activities; and 
A six-factor risk analysis of the following factors: Financial risk, Strategic risk, Reputational risk, National Security risk, 
Operational risk, and Compliance risk. 


The result of the two-tiered risk assessment was a listing of proposed audit projects which were considered in the development of the audit 
schedule. Although the two-tiered risk assessment exercise was conducted for the purpose of the audit project schedule, results were also 
considered when developing the evaluation project schedule and project profiles. 


3. Consultations with Agency senior management: Multiple consultations occurred with the Branch Management Tables, and the CBSA 
President and Executive Committee. Each consultation involved a discussion of the operational risks for the CBSA's programs, 
whether the risks have changed in the past year, as well as any emerging risks. Their input was also sought on the proposed 
schedules to know if there are any contingencies with the delivery of their activities. 


4. Consultations with TBS: The Policy on Results requires that large departments and agencies engage in consultations with TBS during 
the annual evaluation planning exercise. A meeting was held with TBS in January 2018 following which a draft Evaluation project plan 
was submitted. Formal comments were provided to CBSA on the Plan to which IAPED responded and feedback provided was 
incorporated into the evaluation schedule. 


In addition, the IAPED consulted with TBS to provide updates and negotiate extensions to evaluation commitments made as part of TB 
submissions and Memoranda to Cabinet. The results of these consultations are also reflected in the timing of individual evaluations 
noted as TB commitments in the evaluation schedule. 


5. Consideration of intemal and external planned engagements: As part of its planning exercise, the IAPED considered the work of 
internal assurance providers such as the Comptrollership Branch's Intemal Control Review Plan and the plans of external assurance 
providers such as the Office of the Comptroller General (OCG) and the Office of the Auditor General (OAG) to avoid duplication. In 
addition, the IAPED considered planned horizontal evaluations across government as part of its coverage and burden calculations. 


6. Consultations with external AC members: Similar to the consultations with senior management, the external members were asked for 
advice and input on validating the proposed internal audit projects. These discussions helped prioritize and validate the selection of 
possible new audit and evaluation projects and to finalize the audit and evaluation schedules. 

2.4 Step 4: Selection and Timing of Projects 

Selection 

The selection of projects employed a comprehensive approach. After the risk assessment exercise and the consultations were conducted, 


some of the audit and evaluation projects approved in the 2017 Plan were validated to remain. The addition of new projects was made 
based on the methodology used to develop the Plan. 
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A small percentage (i.e. < 15%) of resource hours continue to be reserved for consulting engagements to respond to senior management's 
needs. These engagements are performed outside of the traditional audit and evaluation activities, support the CBSA's needs in a different 
manner. Refer to Appendix F for details on these activities. 


Targeted Control Audit engagements were inserted into the audit schedule this year. These engagements provide reasonable assurance 
that a focused set of controls or processes within an entity are designed and working as intended. In terms of methodology, these 
engagements adhere to intemal auditing standards; however, relative to a typical internal audit, the scope is more narrowly defined, 
focusing on select key controls. 


Timin 
When possible, the timing of each project was established considering numerous criteria, including: 


Agency areas of high risk and significance 

Specific commitments from Memoranda to Cabinet and Treasury Board submissions 
Ongoing and planned external coverage (OAG, OCG, etc.) 

Coordination with internal assurance providers 

Senior management priorities, including the CBSA Renewal initiative 

Previous audit and evaluation coverage 

Coordination between audit and evaluation projects, including potential joint projects 
Knowledge of existing issues and status of implementation of improvements 


3.0 Detailed RBAEP 


This section presents scoping procedures, capacity assumptions, and adjustments made since the 2017 Plan. It also presents the audit 
and evaluation schedules and a brief description of each internal audit and evaluation project to be started during the first year and the first 
quarter of the second year of the Plan. 


Scoping Considerations 


At the CBSA, each audit and evaluation project scope is determined in consultation with the Office of Primary Interest (OPI) and the Office 
of Secondary Interest (OSI) during the planning phase. As per audit standards, the nature and scope of audit engagements are ultimately 
determined by the Internal Audit Division. The engagement plan for each audit considers the Agency strategies, objectives, and risks 
relevant to the engagement. 


In terms of evaluation projects, their scope is determined in collaboration with the responsible Directors General through the Evaluation 
Advisory Committees (EACs) and is presented to the PMEC for approval before the research phase begins. The EACs ensure that the 
OPIs and OSls are engaged at each phase of the evaluation to ensure that findings and recommendations are well understood by program 
and senior management. These processes ensure added value for program management and consider the Agency's information needs, 
while meeting the standards set by Treasury Board policies. 


Capacity Assumptions 


To determine the resource requirements for the proposed internal and external audits and evaluations, it is necessary to make a number of 
assumptions related to the average cost per project, average resource consumption per project and overhead costs (e.g., translation, 
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travel, etc.). These estimates are based on previous internal audits and evaluations completed by the IAPED. The following are the key 
assumptions with respect to delivering this Plan: 


The Internal Audit Division will complete, on average, 8 audit products (including reviews and targeted control audits), and one 
consulting engagement per fiscal year. 

The Program Evaluation Division will complete, on average, a minimum of 4 evaluation products per fiscal year. 

Not all projects require the same level of effort. The number and level of FTEs assigned to a project depends on the complexity level of 
the project. This has been taken into consideration when developing the project schedules. 

Internal audit projects require an average of 12 months to complete. In addition, the Plan allocates one quarter for AC or PMEC 
presentations as well as one quarter to the external publication process. 

Once the audit and evaluation report has been approved by the President, the management action plans (MAP) related to the reports’ 
recommendations are tracked and monitored by IAPED on a quarterly basis. Results are reported to the AC and PMEC as well as the 
Executive Committee quarterly. Resources for MAP monitoring have been allocated in the Professional Practices Division. Audit and 
Evaluation project teams are consulted as necessary on the MAP follow-up activities. 

Consulting engagements typically involve work of a shorter duration than audit/evaluation projects. These engagements are intended 
to provide added value in a timely manner to senior management, and involve a more simplified process compared to the typical 
IAPED projects. Although consulting engagements are not shown in the schedule, resources (approximately 1 FTE) have been 
reserved for this purpose. 

Depending on the scope of the projects, additional professional resources or outside expertise may be required (e.g., international 
benchmarking, subject matter experts, etc.). 


3.1 Adjustments 


This section provides a comparison between the 2017 and 2018 Plans. It is important to note that the planning and program environment is 
dynamic; accordingly, as the Plan is revisited each year, adjustments are occasionally required to ensure it is responsive to emerging 
Agency risks. 


3.1.1 Audits 


The following changes have been made to the internal audit schedule: 


Audits Removed: 


1. 


Audits carried over from the 2017-20 plan to 2018-21 Plan (some with minor changes in timing and or scope): 


3. 
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DONS ER 


Entry/Exit and Radio Frequency Identification Technology 


Audits Added: 


2018-2019 


3.1.2 Evaluations 


The following changes have been made to the program evaluation schedule: 


Evaluations Not Included: 
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1. Detentions: New evaluation not added due to upcoming OAG audit (2018-2019). This program area amounts to 4.75% of 
organizational spending. 

2. Removals: New evaluation not added due to upcoming OAG audit (2018-2019). This program area amounts to 2.68% of 
organizational spending. 

3. Intelligence, Criminal Investigations and Immigration Investigations: New evaluations not added due to recent evaluation coverage of 
each program. This program area amounts to 10.73% of organizational spending. 


Evaluations Removed: 

4. 3l Integration (Intelligence Collection and Analysis, Criminal Investigations, Immigration Investigations): Evaluation was planned for 
2018-2019 but was removed due to recent evaluation coverage of the three individual programs. 

5. Employee Performance Management: Evaluation removed due to other priorities. 

6. Detection Technology: Evaluation removed since this topic will be part of the Field Technology Support evaluation scheduled for Q2 
2018-2019. 


Evaluations Added: 

7. CBSA Assessment and Revenue Management (CARM) (PMEC Q3 2021-2022): Evaluation added as a result of TB submission, and 
the significance of the initiative to the Agency. 

8. Trusted Traveller (Q2 2022-2023): Evaluation added as historically it has been covered however it will be due for another evaluation in 
2023-2024. 

9. Anti-Dumping and Countervailing (PMEC Q4 2021-2022): Evaluation added as historically it has been covered however it will be due 
for another Evaluation in 2021-2022. 

10. Interactive Advance Passenger Information (IAPI) (PMEC Q4 2021-2022): An evaluation was added to the review already planned for 
2018-2019 in order to focus on outcomes. 

11. Recourse (PMEC Q3 2022-2023): Evaluation added to ensure five-year coverage. 


Other changes to evaluation projects were made, mainly to balance previous coverage: 


e Commercial Facilitation and Compliance has been advanced by four quarters due to lack of previous coverage and due to the delay of 
Traveller Facilitation and Compliance; 

e Trusted Trader has been delayed by four quarters due to its low expenditures and scheduling of other priority projects; 

e Traveller Facilitation and Compliance has been delayed by six quarters due to recent evaluation coverage; 

e Studies: Primary Inspection Kiosk (PIK), KPIs and Performance Targets, Postal Operations (Modemization) and Functional 
Management Model. These studies were added to increase the value of evaluation products to senior management. 


Going forward, the evaluation plan will be further adjusted to align with the Agency's Program Inventory developed under the new DRF 


requirement. Any future changes required to the RBAEP schedules will be reported, discussed and approved quarterly at the AC and 
PMEC, as per the usual process. 


3.1.3 External Engagements 


The external engagements are also subject to modifications on an annual basis, based on the respective planning exercises of external 
providers. The following changes have been made to the Plan: 


External Engagements Removed: 
1. Federal Tourism Strategy (lead: OAG, primary entity: Industry) 
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2. Real Property- Global Affairs (lead: OAG, primary entity: GAC) 


External Engagements Added: 

1. Follow-up to the Audit of the Delivery of Bilingual Services to Travellers by the Canada Border Services Agency at Airport and Land- 
Border Crossings (lead: OCOL); 

Government-Wide Departmental Progress in implementing Sustainable Development Strategies (lead: OAG, primary entity: multiple 
departments): 

Healthy Workplaces (lead: OAG, primary entity: multiple departments); 

In-Canada Asylum System (lead: OAG, primary entity: CBSA) 

Immigration Detention and Removal (lead: OAG, primary entity: CBSA) 

Protecting Canada's North (lead: OAG, primary entity: DND) 

Taxation of Cross-Border E-Commerce (lead: OAG, primary entity: CBSA) 

CBSA Consolidated Statements (lead: OAG, primary entity: CBSA) 

Aquatic Invasive Species (lead: OAG, primary entity: DFO) 


N 


«o co 7 CO» O1 c6 


3.1.4 Horizontal Evaluations 


The horizontal evaluations are also subject to modifications on an annual basis, based on the respective planning exercises of other 
federal departments. The following changes have been made to the Plan: 


Horizontal Evaluations Removed: 


1. Intemational Mobility Program (lead: Immigration, Refugee and Citizenship) 
2. Money Laundering and Anti-Terrorism Financing (AML/ATF) Regime (lead: Finance) 
3. Crimes Against Humanity and War Crimes (lead: Justice) 


Horizontal Evaluations Added: 


Citizenship Program (lead: Immigration, Refugees and Citizenship) 
Family Reunification (lead: Immigration, Refugees and Citizenship) 
Drug-Impaired Driving (lead: Public Safety) 

Passenger Protect Program (lead: Public Safety) 

Cannabis (lead: Health Canada) 


c £O. 


Other minor changes were made to the horizontal evaluation projects: 


Federal Contaminated Sites (lead: Environment) will report one quarter earlier; 

Electronic Travel Authorizations (lead: Immigration, Refugee and Citizenship) will start nine quarters later; 

Federal Tobacco Control Strategy and Vaping Activities (lead: Health Canada) will start and report one quarter earlier; 
Guns and Gangs (lead: Public Safety) will report one quarter earlier; and 

Asylum Reforms (lead: Immigration, Refugee and Citizenship) will start ten quarters later. 
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3.2 Internal Audit Schedule 


AC = Audit Committee 


Audit of Occupational Health and Safety. 
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3.3 Internal Audit Project Profiles 


In this section, a brief description for each internal audit project starting in the first year of the planning horizon and the first quarter 
of the second year is presented, along with preliminary objectives, scope, selection rationale, resource estimates, and alignment 
with the CBSA Oversight Universe, risk ranking and alignment with the CBSA ERP. 


Note: Each preliminary proposed project objective and scope will be validated during the planning phase of the engagement 
through project preliminary risk assessment. 


Table 4: 2018-2019 Project Profiles — Internal Audit 
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3.4 Program Evaluation Schedule 


Immigration Hearings 

Officer Induction Model (Previously 
Force Generation) — 

Review of Interactive Ad 


Trade Facilitation and Compliance 


Security Screening 
Traveller Facilitation and 
Compliance 
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3.5 Evaluation Project Profiles 
In this section, a brief description for each evaluation project starting in the first year of the planning horizon and the first quarter of the 
second year is presented, along with preliminary objectives, scope, selection rationale, resource estimates, and alignment with the 
CBSA DRF, risk ranking and alignment with the CBSA ERP. Note: Each preliminary proposed project objective and scope will be 
validated and calibrated during the planning phase of the engagement through evaluation calibration. 


Table 5: 2018-2019 Project Profiles - Program Evaluation 
E1. Stu udy - | oor 


Oy 
OOTO R y Project "y 


B Cee CE NT 
Risk that CBSA'S KPIs pre Oman Performance (Effectiveness): Does the epe pem hei "pum indicators in order 


targets are not valid, that the information | to obtain the right data? Are these indicators providing valid and reliable data? Can 

that they generate are not used for these indicators produce data in a timely manner? Is the data used by senior 

decision-making and reporting, and thus | management to drive change? 

fail to affect positive and/or necessary 

changes. More precisely, the preliminary objective of this study could be to assess the 

This study was requested by the validity and reliability of a sample of the CBSA's KPls. The scope could include a 

Corporate Affairs Branch (CAB) and review of selected key performance measurement indicators/performance targets^, 

supported by the President. as well as factors which could potentially affect their validity and reliability such as 
data integrity (performance reporting, data entry and physical files, systems gaps), 
functional management model, roles and responsibilities of internal and external 


partners, and programs/initiatives' objectives and activities (including consultation 
with relevant stakeholders). In particular, the study could assess whether timing 
(e.g., data collection, analysis, and reporting) aligns with CBSA needs/schedule, 
and if a selection of KPIs results are used for decision-making, and actually enable 
= Dessert E iud EE ts and the achievement of business outcomes. 


Information Management Medium-High Design 
$45,000 Management Capacity 
O&M: 
$75,000 


^ For example, Agency Performance Summary (APS) and Departmental Results Framework (DRF) indicators. 
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This is a new program area and has never been 
evaluated. 

Risk of obsolescence of tools and technology and 
that program outcomes may not be achieved as a 
result. 

This evaluation will occur in advance of the 
implementation of a joint venture with OGDs for a 
shared Scientific Research & Development 
laboratory. 


$390,000 
O&M: 
$46,645 
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Relevance’ TT tree a confining need for the program? Is the program 
aligned to government and Agency priorities? Is the program aligned 
with federal roles and responsibilities? 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources utilized 
in relation to the production of outputs and progress toward expected 
outcomes? Is the CBSA getting sufficient cost recovery from OGDs 
when they use its laboratory services? 


Given the specialized nature of this program area, the scope of the 
evaluation will be further developed in the planning phase. However, 


the preliminary objective of this evaluation could be to assess the 
progress made against the 2014 Ernst & Young review action plan and 
to examine the mandate, effectiveness and efficiency of the 
laboratory's operations. In particular, the evaluation could assess the 
impact on the Agency's results as a consequence of providing services 
to outside clients (RCMP, CRA, etc.), including on finances and front- 
line capacity. The scope could also focus on a review of the program 
area's cost recovery model, as well as the CBSA's readiness for 
entering into the joint venture with OGDs for a shared Scientific 
Misi & iani laboratory. 


cae 
Intelligence and Analysis 
IM/IT 
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There is a risk that the postal modernization initiative | Relevance: Is there a continuing need for the initiative? Is the 
will not achieve the desired outcomes, and that the initiative aligned to goverment and departmental priorities? Is the 
new systems and processes put in place may not be initiative aligned with federal roles and responsibilities? 


Spel ally as ntendedn eflectver tergeung ane Performance (Effectiveness): Are the outcomes of the 


examining increasing volumes of postal packages modernization, as initially designed, being achieved? 

resulting in undetected shipments, further delays, and 

inefficiencies. Performance (Efficiency and Economy): How are resources utilized 
The process for monitoring audit and evaluation in relation to the production of outputs and progress toward expected 
recommendations has identified that the outcomes? How efficient is the distribution of resources across all 
three key postal locations? 


recommendations stemming from the 2016 Internal 


Audit consulting engagement are being addressed at | The preliminary objective of this study could be to assess the 


a slower than expected pace. continued relevance of the initiative, the adequacy of its project plan 
(and its progress) with respect to managing the scope, schedule and 
resources, and the effectiveness of the systems, tools and processes 
already deployed as part of the modernization efforts. More precisely, 
the study could measure the progress, benefits and the achievement 
of business outcomes related to the deployment of key new 
applications such as the risk assessment system (Postal Operation 
Support Tool (POST)), the tariff rating system (Customs Declaration 
System), the automated process on International Conveyor System 
(ICS), and new detection technologies. 


The scope could also include a review of barriers to the achievement 
of the initiative's outcomes and benefits as well as mitigation 
strategies, the status of the initiative's performance measurement 
structure, systems gaps, monitoring and reporting mechanism, roles 
and responsibilities of internal and external partners, the 
communication of the initiative's priorities to the regions as well as the 
distribution of resources to the three key postal locations. An 
environmental scan and a cost/benefit analysis could also be 
performed to assess the impact/extent of e-commerce and the growth 
in mail volumes. 


Commercial/Trade Facilitation and | Medium- Security 
$177,000 Compliance High | Business Design 


O&M: Strategic Planning 
$46,645 IM/IT 
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This program Fa is Seah B TE resource 
development and represents a significant expenditure 
(22.86% of total program spending) for the Agency. 
Due to the scale of this program area, the evaluation 
will need to be scoped properly to ensure it remains 
manageable and delivered within the prescribed 
timelines. 

Previous commercial audits and evaluations include 
the 2017 Evaluation of the Commercial Program in the 
Air Mode, the 2015 Audit of Commercial Rail, the 2014 
Audit of Commercial Air Cargo, and the 2011 
Evaluation of Clearance of Commercial Passenger 
Vessels. 

The program is currently facing challenges in meeting 
its expected results, both in terms of effectiveness and 
efficiency. The program is subject to many external 
pressures that are taxing its ability to deliver, which 
presents risks to Canadians and the Canadian 
economy. 

Increasing volumes, erosion in the capacity to maintain 
historical exam rates, increasing processing delays, as 
well as decreases in resultant examinations expose 
gaps in commercial operations and potential risk for 
the Agency in meeting its safety and security mandate. 


" 


| 
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Salary: $390,000 | 


O&M: $46,645 Compliance 


. 9eiecuon nationale 


e This evaluation is a Treasury Board submission | Performance (Effectiveness): Are outcomes being achieved? 
commitment. 
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Relevance Is there a re = for ther enm Is the 
program aligned to government and Agency priorities? Is the program 
aligned with federal roles and responsibilities? 


Performance (Effectiveness): Are outcomes being achieved? 


Performance (Efficiency and Economy): How are resources utilized 
in relation to the production of outputs and progress toward expected 
outcomes? 


The preliminary objective of this evaluation could be to determine if 
the CBSA has an adequate, effective and rigorous model/process and 
to assess the alignment of the program's priorities with organizational 
priorities and objectives. In particular, the evaluation could review the 
risk-based compliance model's expected outcomes including 
performance measurement indicators/results, examination trends, 
reporting, systems, roles and responsibilities, and program support. 
The scope could also include a review of cost program inefficiencies, 
volumes and implementation of changes to the program. 
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e The initiative has significant funding: $82.4 million to9 | Performance (Efficiency and Economy): How are resources utilized 
Participating Government Agencies (PGAs) in relation to the production of outputs and progress toward expected 
(representing 38 programs) to implement the SWI. outcomes? 


e While the CBSA has succeeded in making SWI 
functionality available, adoption among Trade Chain The preliminary objective of this horizontal evaluation could be to 


Partners (TCPs) is challenging. assess the achievement of the initiative’s outcomes as per its 

e There is a risk that, large projects are taking up most | Commitment to the Government of Canada. In particular, the scope 
of the IT resources, and that internal and external could include a review of performance measurement indicators/results 
clients lack the capacity to implement significant (e.g., onboarding plan for the trade community, incentives to process 
systems and business process changes. transactions through SWI, target date for SWI use, as well as 

e There is a risk of misalignment of workforce adoption results and decommissioning plan for existing OGD service 
competencies with new commercial processes under | Options), training needs and coverage, data integrity (performance 
SWI. reporting, data entry and physical files, systems gaps), functional 


management model, roles and responsibilities of internal and external 
partners (e.g., Stakeholder Management Plan), program support, and 
development, a communication of pro priorities to the regions. 


— IÍ alee aa 


Salary: 555K Commercial/ Trade Facilitation Medium-High | Facilitation 
O&M: $46,645 and Compliance Stakeholder Engagement 
IM/IT 


Rationale - E: ‘ < AG 
This initiative was evaluated in 2012 and audited in Performance (Effectiveness): Are TE being achieved? 


2018. 
There is a risk that the eManifest initiative outcomes Performance (Efficiency and Economy): How are resources utilized 


may not be achieved and that the benefits (i.e., for the | in relation to the production of outputs and progress toward expected 

CBSA as a whole, the end users, but also for the outcomes? 

border services officers and targeting officers) 

associated with its implementation may not be The preliminary objective of this evaluation could be to assess the 

realized. alignment of the initiative's priorities with organizational priorities and 

There is a risk that the adoption rate be lower than objectives, the adequacy of the project plan (and its progress) with 

anticipated to realize benefits. respect to managing the project's scope, schedule and resources, 

There is a risk that large projects are taking up most of | and the effectiveness of the systems, tools and processes already 

the IT resources and that internal and extemal clients | deployed (i.e., do they meet the needs of the end users’). In 

lack the capacity to implement significant systems and | Particular, the evaluation could measure the progress, benefits and 

business process changes. the achievement of business outcomes related to the deployment of 
key new applications such as the Passage System (replacing a 
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e There is a risk of a misalignment of workforce 
competencies with new commercial processes under 
eManifest. 

e There is a risk that the Agency may not fully realize the 
benefits identified at the onset of the project given the 
changes to its originally defined scope (i.e. de-scoping 
of electronic risk assessment of crew, re-manifest 
information and deferral of rollout of passage). 
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portion of ACROSS) and the Commercial Threat Assessment System 
(CTAS) replacing the current TITAN system. 
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3.6 Consulting Engagements 


Consulting engagements harness the IAPED's expertise to better support the Agency in a less prescriptive, more responsive and 
business-driven way by providing a broader spectrum of products that meet management's needs and address key risks. These 
engagements may be performed at any stage, from the beginning to the end of a project (e.g., planning, research and reporting 
phases) or program (e.g., design, development and full implementation phases). They may also leverage the Agency's subject matter 
experts. Specific examples of consulting engagements can include the following: 


Review the relevance of the CBSA's involvement in programs 

Pre-implementation audits/evaluations (at the outset of programs) 

Advice on methodology (for programs performing their own internal reviews or monitoring) 
Review of efficiency proposals: did the Agency obtain the desired results? 

Review of complex Memoranda to Cabinet or Treasury Board submissions 

Risk assessments 


9o o7 ES D = 


The consulting engagements ultimately conducted by the IAPED will be decided upon in consultation with CBSA senior management. 
3.7 Projects in Reserve 


In accordance with standards, the CAEE will review and adjust the plan, as necessary, in response to changes in the Agency's 
business, risks, operations, programs, systems, and controls. In some instances, a planned audit or evaluation may be postponed or 
cancelled by the AC or PMEC. Consequently, other projects may be advanced or other projects may be conducted due to an already 
complete schedule. The IAPED has compiled the following list of projects in reserve that may be conducted in such instances. 


Internal Audit Program Evaluation 
3l Integration (Intelligence Collection and Analysis, Criminal 
Investigations, Immigration Investigations) 
Employee Performance Management 


Trusted Trader Pilot - Secure Corridor Concept (Study) 
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4.0 RBAEP Summary 
4.1 Summary of Projects by Branch 


The following graphics summarize the IAPED's planned activities expected to be completed over the audit and evaluation planning horizon, in addition to external audits and 
horizontals evaluations, by Branch. 


Graphic 2: Projects Ending by Branch and Fiscal Year 


Projects Ending in 2018- Projects Ending in 2019- 
2019 by Branch 2020 by Branch 
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5 Only includes confirmed OAG projects up to 2019-2020. 
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Legend: 


CAB: Corporate Affairs Branch 
CARM: CBSA Assessment and 
Revenue Management Branch 
CB: Comptrollership Branch 

CTO: Chief Transformation Officer 
HRB: Human Resources Branch 
ISTB: Information, Science and 


Technology Branch 

OB: Operations Branch 

PB: Programs Branch 

SPB: Strategic Policy Branch 
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4.2 Commitments 


This section lists the CBSA commitments stemming from external assurance providers, Memoranda to Cabinet or Treasury Board 
submissions, including for Beyond the Border initiatives that were included within the audit and evaluation schedules. 


Audit Schedule: 
1. Entry/Exit and Radio Frequency Identification Technology will be tabled at AC in 2022-2023. 


Evaluation Schedule: 

1. Interactive Advance Passenger Information will be tabled at PMEC in Q4 2021-2022 ; 

2. Single Window Initiative will be tabled at PMEC in Q4 2019-2020; and 

3. Entry/Exit and Radio Frequency Identification Technology will be tabled at PMEC in Q1 2022-2023. 


5.0 Conclusion 


This Plan demonstrates the IAPED's continuing effort to provide the CBSA senior management with valuable audits and evaluations of the 
Agency's programs and initiatives. The timing of projects identified in the Plan reflects program risks, as well as priorities and issues identified 
through consultations with Agency senior management and IAPED employees. The IAPED will assess and revise the Plan annually in order 
to ensure that maximum oversight is achieved based on available resources and to consider senior management needs and commitments. 
Progress on the Plan's implementation is reported quarterly to the AC and the PMEC for accountability purposes as well as part of the 
CBSA's oversight responsibilities. 
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Appendix A: Coverage of Enterprise Risks!!! 


This appendix presents the enterprise risk rating and the coverage offered by the projects identified in the 2018 RBAEP. 


Enterprise Risks 


Intelligence and Analysis | Audit projects: 
e Audit of Advanced Commercial 
Information Systems Data Quality/ 


Integrity 


a 
e 
Trade Revenue Audit Projects: 
e Audit of Revenue Collected by the CBSA 


Facilitation Audit projects: 
e Audit of Commercial Marine Program 
e Audit of Advanced Commercial 
Information Systems Data Quality/ 
Integrity 


Funding Model 
IM/IT Audit projects: 
e Audit of Advanced Commercial 
Information Systems Data Quality/ 
Integrity 


Organizational Culture Audit projects: 


Audit of Occupational Health and Safety 


' Based on the update of the 2017 Enterprise Risk Profile. 


Risk Rating and Coverage of Enterprise Risks (For Year 1 Internal Projects) 


Evaluation projects: 
e Review of Interactive Advance Passenger 
Information (IAPI) 


Evaluation projects: 
e Immigration Hearings 


Evaluation projects: 

e  Anti-Dumping and Countervailing 

e CBSA Assessment and Revenue Management 
(CARM) 


Evaluation projects: 
e Study - Primary Inspection Kiosk (PIK) 


Evaluation projects: 

e Study- KPIs and Performance Targets 

e Buildings and Equipment (Previously Infrastructure 
and Materiel) 

e Study - KPIs and Performance Targets 


Evaluation projects: 
e Field Technology Support (Previously Science and 
Engineering) 


Evaluation projects: 
e OIM (Previously Force Generation) 
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Appendix B: Detailed Schedule Information 


The schedule is the aggregation of all internal and external audits and evaluations planned over the next five years. The external and internal factors discussed in section 2 
contribute to an extensive list of 75 projects. Of these, 38 projects (51%) are in various stages of progress in the first year only. Audits and extemal engagements are not reflected in 
year four and five of the Plan since audit projects are identified on a three-year basis and because external stakeholders do not plan more than three years (sometimes two years in 
the case of the OAG) ahead. The evaluation function requires the identification of projects over a five-year period. 


In the following table, the start date for a project is typically the first month within the quarter identified, whereas the completion date is usually the last month within the last colored 
quarter. Details regarding scheduled AC and PMEC dates are provided at the bottom of the schedule. 

Legend: 
CC SO S d 
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H | Horizontal Evaluation 
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Traveller Facilitation 
and Compliance 


Traveller Facilitation 
and Compliance 


Study - Primary Inspection Kiosk (PIK) 


Biometrics and Immigration Information Sharing Initiative 
(lead: Immigration, Refugees and Citizenship)" Investigations 
Follow-up fo the Audit of the Delivery of Bilingual Services Human Resources 

fo Travellers by the Canada Border Services Agency at Management 

Airport and Land-Border Crossings (lead: OCOL) 

Audit of Commercial Marine Program 
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Govemment Wide Departmental Progress in Implementing Infrastructure and Extemal Management and 
Sustainable Development Strategies (lead: OAG, primary £3 |Environmental Operations | Engagement Oversight N/A 
lh 


IA | Audit of Revenue Collected by the CBSA 


Audit of Occupational Heath and Safety g i Policy on intemal — | Human Resources 
i Audit 


EX | Aquatic Invasive Species (lead: QAG, primary entity: Commercial Programs Extemal Commercial / Trade 
Compliance 


A Extemal 


In-Canada Asylum Process (lead: OAG, primary entities: 


d IRCC and CBSA) 
2 


2 


NM 
p 


NM 
a 
m 


Field Technology Support (Previously Science and Science and Engineering — | Policy on Results | Field Technology 
Engineering) E Support 
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2018-2019 2019-2020 2020-2021 2021-2022 2022-2023 


Office of Primary Interest f 
Planned Projects | A WU 4 2 2019 DRF 
(Director General Level) Commitment 


Coverage % 


Qi Q2 AEN" UE 03 G4 Qt MEM Q4 


E | Study- Postal Operations (Modemizaton) ‘Commercial Programs Not applicable Commercial / Trade 
Facilitation and 
Compliance 


immigration Detention and Removal (lead: OAG, primary 
entity; CBSA) 


Enforcement and Intelligence | Extemal 
Programs Engagement 


Bü 
EX  |Protecting Canada's North (lead: OAG, primary entity: Commercial Programs Extemal 
DND) Engagement 
fe 
e 


6 
7 
8 
0 
1 
2 


2 
2 
2 
3 
3 
3 


Taxation of Cross-Border E-Commerce (lead: OAG, Traveller Programs Exiemal Traveller Facilitation 
Engagement and Compliance 


primary entity: CBSA) 
Agency Comptroller External Financial N/A 
Engagement Management 
Enforcement and Intelligence |IRCC MC Security Screening NIA 
Programs Commitment 


enity: CBSA) 
Citizenship Program (lead: immigration, Refugees and 
Citizenship) 
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2018-2019 2919-2020 2020-2021 


2021-2022 2022-2023 
C" - Office of Primary Interest Source of 


2018-2019 DRF 
(Director General Level) Commitment od 


Coverage % 


Q2 03 Qs a G2 03 G4 Qt © 


| E m 
Single Window Initiative (Horizontal Evaluation)" ** 


Commercial Portfolio / TB Commitment 
Commercial Programs 


Commercial Portiblio / Policy on Results | Commercial / Trade 


Commercial Programs Facilitation and 
Compliance 


Electronic Travel Authorization (eTA) (lead: Immigration, Traveller Programs IRCC MC Traveller Facilitafion 
Refugees and Citizenship)" Commitment 
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Services Agency frontaliers du Canada 


2016-2019 2019-2020 2020-2021 


2021-2022 2022-2023 
C" - : Office of Primary Interest Source of 


2018-2019 DRF 
(Director General Level) Commitment od 


Coverage % 


Qi Q2 XM Qi Qi Q3 a Q1 Q2 03 G4 Q1 G2 v Q4 


Trade Facilitaton and Compliance 


Trade and Ant-Dumping 


Intemational Region Policy on Results | Security Screening 


Traveller Programs Policy on Results | Traveller Faciltaion 
and Compliance 
3876 


= Buildings and Equipment (Previously Infrastructure and Infrastructure and 


Policy on Results | Buildings and Equi 
Materiel) Environmental Operations 
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2018-2019 2019-2020 2020-2021 2021-2022 2022-2023 


Office of Primary Interest rce of 
Planned Projects ice of Primary inter Sou 


201 DRF 
(Director General Level) Commitment tan 


Coverage % 


Qi O2 03 G4 Qi M" M O2 M | 0 M QG Qt à Q4 


Federal Tobacco Control Strategy and Vaping Activities Enforcement and Intelligence e E Commercial / Trade 
(lead: Health Canada) Facilitation and 


Eu. pliance 


=== obs 
. Programs 

D cll me 
Citizenship) Commitment 


TB Commitment | Financial 
Management, 
Information 
> 


= = 
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Services Agency frontaliers du Canada 


2018-2019 2019-2020 2020-2021 2021-2022 2022-2023 


Office af Primary Interest Source of 


Planned Projects 
l Director General Level) Commitment 


2018-2019 DRF 


Coverage % 


Qi a 03 ua Qi M" —— OM O2 M | 0M U Qt R 


Trade and AnbDumping [Policy on Results |Anf-Dumping and 
Programs Countervaling 037 g 


STT T EAN — 
Citizenship) Programs Commitment and Compliance 
O EERE 
Commitment and Compliance 
EERE 
Commitment and Compliance 
PTET TTT TT tT Ee Tet TT | | Ml 
Commitment and Compliance 


E EEREEEEREREE | | 
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Appendix C: External Audit Engagements Schedule 


CBSA Office of Primary Interest Source of 2018-2019 2018-2019 2019-2020 2020-2021 


(Director General level) Commitment DRF 


Qt Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 O2 Q3 Q4 
Human Resources: Human Resources |External IS 
Programs Engagement 


Planned External Audit Projects 


Comptrollership Branch: Infrastructure Exernal 
and Environmental Operations Engagement 


Comptrollership Branch: Agency External IS 
Comptroller Engagement 


Commercial / 
Trade Facilitation 
and Compliance 


Programs Branch: Enforcement and External Border 
Intelligence Engagement Enforcement 
Exernal Commercial / 
Programs Branch: Commercial Programs Trade Facilitation 
Engagement ; 
and Compliance 
Traveller 
Programs Branch: Traveller Programs ERA! Facilitation and 
Engagement : 
Compliance 


comple — emen | © | | | | 
Comptroller Engagement 
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Appendix D: Horizontal Evaluation Schedule 


CBSA Office of Primary 
Interest 


2018-2018 2019-2020 2020-2021 2021-2022 2022-2023 


Planned Horizontal Evaluation Source of 2018-2019 


Projects Commitment DRF 


Q1 Q2 o3 QA: Qt Q2 Oe Q4 OF Qz: Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Qs Q4 
Traveller 
IRCC TB robot 
A Facilitation & N/A 
Commitment i 
Compliance 


(Director General level) 


m Comptrollership Branch: Pp 
m i : : Buildings and 
Infrastructure and Environmental Policy on Results 4 N/A 
~ $ Equipment 
IRCC MC Security 
i Commitment Screening 
Programs Branch: Traveller IRCC MC HAS 
4 Facilitation & 
Programs Commitment a 
Compliance 
Commercial / 
HC TB Commitment |Trade Facilitation 
and Compliance 
IRCC MC Security 
Commitment Screening 
" Intelligence 
Public Safety TB Collection & 
Commitment z 
Analysis 


Traveller 
Facilitation & 
Compliance 
Traveller 
Facilitation & 
Compliance 
Traveller 
Facilitation & 
Compliance 
Traveller 
Facilitation & 
Compliance 


zZ zZ F4 2 0veragesá. 
EJHESESHESES — 


£ 
» 


ES 


Public Safety MC 
Commitment 


Health Canada TB 
Commitment 


** Program includes a Beyond the Border initiative component, or is a stand-alone Beyond the Border initiative. 
N/A = The cost of this program is included within another larger program already accounted for in this plan. 
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Appendix E: Audit and Evaluation Suite of Services 


Internal Audit 


Engagement Provides independent, 

Description: objective assurance on 
govemance, controls and 
risks. 


- 12 months 


Reporting: Formal report. 
Presented at AC. 


Approved by the President. 


Publication Published 


Targeted Control Audit 


Provides in-depth testing of 


selected key controls. 

Narrow scope to allow for 
timely reporting and corrective 
action. 


3 to 6 months 


Flexible reporting (i.e. deck or 
report). 

Presented at AC. 

Approved by the President. 


Published 


Reviews 


Provides broad or targeted 
information, with less depth 
and coverage. 

Some reviews are the result of 
an audit being downgraded 
due to insufficient controls to 
perform testing. 


6 to 9 months 


Flexible reporting (i.e. deck or 
report). 

Presented at AC. 

Approved by the President. 


Not published 
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Advisory! Consulting 


Requested by management, who plays a significant role 
in defining the objectives and scope of the engagement. 


3 to 6 months 


Flexible reporting (i.e. deck or report). 


Not published 
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+ Typically focus on programs, policies and priorities and examine 
uestions related to relevance, effectiveness and efficiency. 
cope is defined via a formal planning phase that includes IAPED's 


q 
S 


10 to 12 months 


Formal report. 


Presented at PMEC. 
Approved by the President. 


_ Published 


Program Evaluation 


Provides objective, timely and reliable insights on significant or 
emerging questions using the rigour of evaluation methodology 
(e.g. surveys, benchmarking, time-motion studies, etc.). 

They are scoped in conjunction with management and provide 
valuable information for decision-making purposes. 


<9 months 


Flexible reporting (i.e. deck or report) 


Not published 
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Appendix F: DRF Coverage 


p 
LLLI Q> Passes 9 $ Bent stia 
DRF Element FY 2007-08 to FY 2012-13 FY 2013-14 FY 2014-15 FY 201516 | FY 2016-17 Tra ima Delect : dio i D 
Underway (2018-19) 3 
e a A 3 HH EH g à 
Targeting 1) Pre-Arrival Targeting (2007-08) 1) Centralized 1) Review of interactive *Targeting Program sEvaiuation of Targeting (2020-2021) 
2) National Targeting Implementation Project (2012-2013) Targeting Advanced Passenger Information Management Committee *Evaluation of [API (2020-2021) 
2) National (Underway) (Commercial) 
Targeting Medium Coverage «Weekly reporting on 
closing the loop on targets 
and lookouts 
Intelligence (1) Crimes Against Humanity and War Crimes (2008-2009) 1) Measures to |1) Great Lakes |: 1) Entry/Exit Initiative Review *Lookout SOPs (Appendix «Horizontal Evaluation Guns and Gangs (2021- 
Collection — 2) National Security: intelligence and Information Sharing (OAG) Address Marine Security |I 2) National Anti-Drug Strategy G) outlines Lookout 2022} 
and Analysis (2008-2009) Contraband — |Operations | (lustice} Performance Monitoring sEvaluation of SWI (2018-2018) 
3) Emergency Management-Public Safety Canada (OAG) (2009- [Tobacco {P5} |Centre (RCMP) 3) National Action Plan to and Reporting Processes, 
2010) 2} G8/G20 2) Intelligence Combat Human Trafficking (P5) including Quality Reviews 
4} National Anti-Drug Strategy (DOJ) (2009-2010) Summits — Program of Lookout Issuance and 
5} Port Runners (Special Study) (2009-2010) {RCMP} H Maintenance and monthly 
&} Assessment of CBSA Participation in BEST (2009-2010) 3)Lookouts- |! reporting to Performance 
7} integrated Proceeds of Crime Initiative (PS) (2010-11) Traveller Mode High Coverage Reporting Unit (Ops) 
8) Status on Anti-Terrorism Follow-up (OAG) (2012-2013) 4) Telephone 
9} National Anti-Drug Strategy (DOI) 2012-2013} Reporting 
10] 2010 Olympics (RCMP] {2012-2013} Program 
11) Federai Tobacco Control Strategy (HC) (2012-2013) 
12] information Sharing Between the CBSA, CIC, and CSIS (2011- 
2012) 
13] Temporary Foreign Worker Program-(HRSDC] (2012-13) 
Security 1] Admissibility Screening and Supporting intelligence Activities 1) Smail and 1) Operation Syrian Refugee *NSSD QA Program | «Horizontal Evaluation of Citizenship Program 
Screening {2009-2010} Remote Ports of 2) Immigration and Citizenship | (2018-2019) 
2] Remote Border Location Programs (2009-2010) Entry Screening (CSIS- Study) Evaluation of Security Screening (2019-2020) 
3) Securing Canada's Borders (OAG) (2012-13) Medium Coverage *Horizontal Evaluation of Family Reunification 
4) Securing Borders - Follow-up (OAG) (2012-13) (2020-2021) 
5) Border Control for Marine Ports of Entry (2012-13) 
Traveller 1) Control and Disposal of Goods Seized Under the Customs Act |1} Traveller 1) Food, Plant 1) Review of |1} Traveller Processing (Marine *Management Practice «Horizontal Evaluation of Electronic Travel 
Facilitation (2008-9) Processing land Animal the Federal — Mode) Assessments Authorizations (2019-2020) 
and 2) Managing Risks to Canada's Plant -}Resources—Canadian {Highway and |2) Follow-Up on Government |2) Preventing Corruption in *Port Program Evaluation of Travaller Facilitation and 
Compliance Food Inspection Agency (OAG) (2008-9) Rail] Control and investment in |Immigration and Border Services Assessment Corepliance (2019-2020) 
3) Privacy in Air Travel (2008-9) Disposal of Toronto 2015 |(OAG) *Evaluation of Entry/Exit and RFID 2021-2022] 
4] Western Hemisphere Travel Initiative (WHTI) (2010-11) Seized Goods Pan and 3) Review of Interactive *Horizontal Evaluation of Asylum Program (2021 
5) Issuing Visas (OAG) (2011-12 Parapan Advanced Passenger Information = 2022) 
i ta S EE Aver oe (Underway) d High Coverage Medium High Horizontal Evaluation of Drug-Impaired Driving 
7)High Risk Traveller Identification (HRTI) (OPC) (2012-13) Games 4) Primary Inspection Kiosk - (2022-2023) 
[Heritage (Underway) sHorizontal Evaluation of Passenger Protect 
Canada) 5) Temporary Resident Program 12022-20231 
Biometrics Project and sHorizontal Evaluation of Cannabis (2022-2023) 
Immigration Information Sharing 
(RCO (Underway) 
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Agence des services 
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DRF Element 


FY 2007-08 to FY 2012-13 


FY 2013-14 FY 2014-15 


FY 2015-16 


FY 2017-18 and Projects 
Underway (2018-19) 


Commercial- 
Trade 
Facilitation 
and 
Compliance 


1) Sufferance Warehouses Security (2007-08) 

2) Rail Export Verification Unit (2007-08) 

31 Commercial Examination Processes and Detection Technology 
(2008-09) 

4} Export Programs (2008-03) 

5)CBSA-Licensed Warehouse Programs: Sufferance and Customs 
Bonded Warehouses (2009-10) 

6) Harmonized Risk Scoring-Advance Trade Data 

7) Drawback Program (2010-11) 

8) Facilitating the Flow of Imported Commercial Goods—Canada 
Border Services Agency (OAG) (2010-11) 

9)Border Controls on Commercial imports (OAG) (2011-12) 

10) Clearance of Commercial Passenger Vessels {2011-12} 


1} Trade 
incentives, 
Licensing and 
Registration 
programs 

2) Casual Refunds 
3) Export 
Programs 

4) Commercial 
Air Cargo 


2} Revenue 
and Trade 
Management 
{Trade 
Compliance} 


1) Audit of B2 
Refunds 

2) Commercial 
Rail 


1) Custom Duties (OAG) 

2) Commercial Processing (Air 
Mode) 

3) Border Controls for Marine 
(Underway) 

4) Aquatic invasive Species (OAG} 
(Underway} 


PROTECTED A 


gue 


*Management Practice 
Assessments 

*Port Program 
Assessment 

*Trade Compliance- 
Quality Assurance and 
Verification Units 


| 
‘ 
t 
( 


* Protecting Canada's 
North (lead: OAG, 
primary entity: DND) 


CBSA - Released under the Access to Information Act 
ASFC - Divulgation en vertu de la loi sur l'Accès à l'information. 


(2018-2019) 

Evaluation of Commercial Facilitation and 
Compliance (2018-2019) 

«Evaluation of eManifest (2019-2020) 
*Evaluation of Trade Facilitation and 
Compliance (2019-2020) 

*Horizorital Evaluation of Federal Tobacco 
Control Strategy and Vaping Activities (2020- 
2021) 


Trusted 
Traveller 


1) NEXUS Application Process (2007-8) 
2) NEXUS Highway and FAST Programs (2008-9} 
3) Trusted Travellers (2012-13) 


Trusted 
Trader 


1) Trusted 
Traveller 


UCustoms Self-Assessment (2007-08) 
2)Customs Self-Assessment( 2009-10) 
3) Partners in Protection (2010-11) 


1) Trusted 
Traders 
Programs 


1} Trusted 
Traders 


Low Coverage 


Low Coverage 


*Evaluation of Trusted Traveller {2022-2023} 


Evaluation of Trusted Trader (2022-2023) 


Anti-Dumping 
and 
Countervailing 


1)Anti- 
dumping and 
Countervailing 
Program 


1) Customs Duties (OAG) 


Low Coverage 


*Evaluation of Anti-Dumping and 
Countervailing (2021-2022) 


Recourse 


1) Recourse (2012-13) 


1) Recourse 


Low Coverage 


Force 
Generation 


1) investments to Combat the Criminal Use of Firearms (2010-11) 
2) CBSA's Participation in Joint Force Operations (2011-12) 


1) Officer Induction Model 
{Underway} 
2) Healthy Workplaces (OAG) 


Low Coverage 


Buildings and 
Equipment 


1) Federal Contaminated Sites 
Action Plan (EC) (Underway) 


Low Coverage 


Building Conditions 
Reports 


Field 
Technology 
Support 


1) Laboratory Services (2010-11) 
2) CBSA Policy on the Overt Use of Audio-Video Monitoring and 
Recording" Technology (letter) (OPC) (2010-11) 


Low Coverage 


*Verification of Large 
Scale Imaging 


sEvaluation of Recourse (2021-2022) 


*Audit of In-Service 
Training and 
Development of 


*Evaluation of Buildings and Equipment (2020- 
2021) 


*Evaluation of Field Technology Support (2018- 
2019) 


Notes 


Note 1- The effectiveness of the second line of defense activities has not been tested. This column is used to indicate the presence of activities. 


Note 2- The risk and significance rating is a product of the comprehensive risk assessment process that was undertaken during the RBAEP development process. The RBAEP team conducted a 
risk and significant assessment on all audit universe elements which has been rolled up to the DRF level for presentation purposes. 
Factors considered in the detailed assessment include materiality, risks identified during key document reviews, risks identified during consultations, past assurance coverage, outstanding 


management action plans (resulting from previous recommendations), maturity, and alignment with Agency or senior management priorities. 
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8 E) E C] 3 H 
0 Trternal Andi [ pau 0 8 Horn eu 
: - o eO 
DRF Element FY 2007-08 to FY 2012-13 ry 2013-4 | FY214-15 | Fv200516 | ry201617 | "2017-18 md Projects NDAEP as 
Underway (2018-19) g 
Immigration |!) Immigration Controlled Forms (2007-8) 1) Immigration |1) Audit of 1) 
Investigations 2) Security Certificate Initiative (PS) (2009-10) investigations — Immigration 2) In-Canada Asylum System Medium Coverage 
Enforcement {OAG) (Underway) 
Detentions — |!) Detention and Removal of Individuals - CBSA (OAG) (2008- 1) Toronto Bail Program Review *Detentions Quality «Immigration 
9) 2) Detentions and Removals Assurance Program Detention and 
2) Detentions and Removals Program (2010-11) (OAG) (to be launched) *Red Cross and UN Removal (lead: OAG, 
Monitoring primary entity: 
CBSA 
Low Coverage ) 
Hearings Das 
immigration Hearings 
(Underway) Low Coverage 
Removals (1) Detention and Removal of Individuals - CBSA (OAG) (2008- |1) Refugee — |1) Assisted 1) Immigration «External Audit of 
9) Reform Voluntary Retum and Refugee Immigration 
2) Detentions and Removals Program (2010-11) Initiative and Reintegration Protection Act Detention and 
(AVRR) Pilot Division _ Removals (2018- 
9/National 2019) 
Security Medium Coverage 
inadmissibility 
initiative (PS) 
2) In-Canada 
Asylum System 
i cy 
Criminal T) Integrated Border Enforcement Team Program (OPC) (2009- D Criminal 1) Citizenship 
Investigations |10) investigations |(OAG) 
23 Criminal Investigations Program (IKPA) (2010-11) Program Low Coverage 
3) CBSA’s Enforcement Teams Q011-12) 
Notes 


Note 1- The effectiveness of the second line of defense activities has not been tested. This column is used to indicate the presence of activities. 
Note 2- The risk and significance rating is a product of the comprehensive risk assessment process that was undertaken during the RBAEP development process. The RBAEP team conducted a risk 


and significant assessment on all audit universe elements which has been rolled up to the DRF level for presentation purposes. 
Factors considered in the detailed assessment include materiality, risks identified during key document reviews, risks identified during consultations, past assurance coverage, outstanding management 


action plans (resulting from previous recommendations), maturity, and alignment with Agency or senior management priorities. 
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e Internal Audit Oe a 0: € Revers Prairies 
. n h 
DRF Element FY 2007-08 to FY 201213 FY 21314 | FY21415 | FY20IS16  pyaoçiz | FY 2017-18 and Projects " aE iame 0n m 
Underway (2018-19) : i 
um 
RTE Due B D 
Management |1} Emergency Preparedness (2008-9) 1) 2012-2013 1)Business |1} Departmental Progress in *Management Practice *Study- KPls and Performance Targets (2018- 
and Oversight |2} Business Continuity Plans (2009-10) Departmental Continuity — implementing Sustainable Assessment 2019} 
3} CBSA-CFIA MOU (2009-10) Performance Planning Development Strategies (OAG} eInternal Control Plan: *Study- Functional Management Model (2020- 
4) Administration of Permit, Licences and Other Requirements for Report 2) Audit of Access (Underway) Entity Level Control Project 2021} 
Commercial Goods (2009-10) 2) Enterprise Risk to Information *Monitoring by DSO 
5} Federal Annual Privacy Reports - Section 37 of the Privacy Act {OPC} Management and Privacy (passwords and document 
{2009-10} scanning) 
6} CIC-CBSA Memorandum of Understanding {2010-11) 
7) Process Monitoring Framework (2011-12) High Coverage 
8} internal Audit (Government wide performance audit on Internal Audit} 
(OAG) (2011-12) 
9} internal Audit Policy Implementation (T85) (2011-12; 
(Communication 
Services Low Coverage 
Legal Services i n . 
eLitigation Review : 
Low Coverage (Recourse) Medium : 
Human 1) Arming Initiative (2008-9) 1) Leave 1) Professional 1) Audit of Classification *HRB compliance | 
Resources 2) Staffing Management Accountability Framework (2008-9) 2) Official Standards 2) Preventing Corruption in monitoring (staffing) : 
Management |3} Federal Student Work Exchange Program (PSC) (2008-9) Languages 2) Arming Immigration and Border Services *Monitoring of Interchange i 
Services 4} Government-wide audit of Executive Appointments (PSC) (2008-9) (OCOL) {GAG) Canada Assignments 
5) Engagement of Human Resources Planning {OCG} (2008-9) *Internal Control Plan: 
6} Employment Equity Audit Report - File#72820-02-C14-2008 (CHRC) Internal Control 
(2008-9) Compensation Project 
7) Occupational Health and Safety (2009-10) *Management Practice 
8) CBSA Audit of the Staffing Framework Audit (PSC) (2009-10) 6} PSC Staffing Assessment Assessment 
$5 Arming Initiative (2009-10) *Overtime and leave usage 
10) Employer-Employee Relationship with Contractors (2010-11) High Coverage monitoring 
11)Training and Learning (2011-12) 8) Occupational Health and 
12]Follow-up of the Public Service Commission's 2009 Audit of CBSA Safety (Underway) 
Human Resources Staffing (2011-12) 9} Follow-up to the Audit of the 
13) Employment Equity (OPC) (2011-12) Delivery of Bilingual Services to 
14) Part of Entry Recruitment Training (POERT) (2011-12) (Travellers by the Canada Border 
15) Staffing Compliance (2012-13) Services Agency at Airport and 
Land-Border Crossings (OCOL} 
{Underway} 
10} Healthy Workplaces (GAG) 
{Underway} 
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@ internal dudit D buste [ € Berze d balades 
- t RE Roa 
DRF Element FY 2007-08 to FY 2012-13 FY 201314 | FY201415 | FY20IS16 | pvameiz | FY 20178 and Projects ; es Menus 
Underway (2018-19) 
Financial 1) Fiscal 2006-2007 Year-End Cash Cut-Off Procedures (2007-8) 1} Overtime  |1} Public 1) Public 1} Public 1} eManifest (financial audit) FMA Review/Challenge *OAG Public Accounts |*Evaluation of CARM (2021-2022) 
Management |2} Travel and Hospitality (2007-8) Management |Accounts (OAG) |Accounts (OAG) [Accounts {OAG} |Z} CBSA Transactions and function (annual) 

3) Fiscal 2007-2008 Year-End Cash Cut-Off Procedures (2008-9) 2) Financial Financial Information (OAG- *Internal Control Plan: 
4) Delegated Authority under Section 34 of the FAA (2008-9) Forecasting formerly Public Accounts) Budgeting & Forecasting 
5) Public Accounts (DAG) (Annual) 3) Public Project 
6) Fiscal 2008-2009 Year-End Cash Cut-Off Procedures (2009-10) Accounts *Internal Control Plan: 
7) Delegated Authority under Section 33 of the FAA (2009-10) (OAG} 4) Audit of Revenue Collected by Project Management 
8) CBSA Revenue Ledger (2009-10) the CBSA (underway) *Internal Control Plan: 
9) Horizontal Expenditure Controls (Higher-Risk Payments) (OCG} (2009- Accounts Receivable Ledger 
10) Project 
10) Payroll Controls (2009-10) *Internal Control Plan: : 
11) Acquisition Cards (2009-10) High Coverage Public Account | |*CB5A Consolidated 
12) Canada’s Anti-Money Laundering and Anti-Terrorism Financing Regime *Internal Control Plan: Statements (lead: CAG, 
m {Finance} (2010-11) Interdepartmental primary entity: CBSA} 
13) Fiscal 2009-2010 Year-End Cash Cut-Off Procedures (2010-11) Settlements 
14) Financial Management Framework (2010-11) *Internal Control Plan: 
15) Payment Process for K84 Account Statements (2010-11) Hospitality/ Travel/ Events 
16) Accounts Receivable (2011-12) * Internal Control Plan: B2 
17) Fiscal 2010-2011 Year-End Cash Cut-Off Procedures (2011-12) Refunds 
18) Expenditures for the G8/G20 Summits (OAG) (2011-12) *Internal Control Plan: B3 
19) Overtime Claim Review (2011-12) Revenues Program 
20) Fiscal 2011-2012 Year-End Cash Cut-Off Procedures (2012-13) Account Verification 


Notes 

Note 1- The effectiveness of the second line of defense activities has not been tested. This column is used to indicate the presence of activities. 

Note 2- The risk and significance rating is a product of the comprehensive risk assessment process that was undertaken during the RBAEP development process. The RBAEP team conducted a risk and 
significant assessment on all audit universe elements which has been rolled up to the DRF level for presentation purposes. 

Factors considered in the detailed assessment include materiality, risks identified during key document reviews, risks identified during consultations, past assurance coverage, outstanding management action 
plans (resulting from previous recommendations), maturity, and alignment with Agency or senior management priorities. 
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PROTECTED A 


ie Canada Border — Agence des services 
: Services Agency frontaliers du Canada 


0. 0 — Hess Qo e Boross Bealnating 


DRF Element FY 2007-08 to FY 2012-13 FY 2013-14 FY 2014-15 FY 2016-17 


FY 2017-18 and Projects 
Underway (2018-19) 


Information 1) Horizontal Audit of Electronic Recordkeeping {OCG} (2011-12) 1) Information 
Management  |2) Information Management (2011-12) Management Medium Coverage 
(with OCG) 


Information 1)IT Systems under Development — Phase 2 - ACI/EDI for Air (2007-8) Internal Control Plan: “Evaluation of CARM (2021-2022) 
Technology 2) IT Systems under Development — Phase 3- API/PNR Risk Scoring (2007-8) |: 2) Advanced Commercial Project Management 
3) IT Infrastructure Service Delivery Agreements (2007-8) ; Information System Data 
4) IT Infrastructure, General Controls (2008-9) Quality/Integration- Air 
5) System under development - eManifest (2009-10) (underway) 

G}Aging Information Technology Systems (IT Environment Survey) (GAG} 
(2010-11) . 
7) CBSA Policy on the Overt Use of Audio-Video Monitoring and Recording" 
Technology (letter) (OPC) (2010-11) 
8) Horizontal Internal Audit of IT Asset Management in Large Departments |3) eManifest 
and Agencies (OCG) (2010-11) Project 

3} IT Desktop Services for CBSA End Users (2010-11) Governance 
10) System Under Development — eManifest (2010-11) and Reporting 
11) Technology Security — MITS — Phase | (2011-12) 
12) eManifest Project Management Review (2012-13) 
13) eManifest (2012-13) 


High Coverage 


Real Property 1) Real Property Infrastructure 


*Building Conditions Reports 
Services Management 


*Threat risk assessment (by 


Low Coverage DSO) 


Materiel 1} Fleet Management (2007-8) *QA by Contract and 
Services 2) Asset Management Detection Technology Equipment (2008-9) Procurement Officers 


3) CBSA Fleet (2009-10) Low Coverage Hoos Plan: 


Acquisition 1) IT Services Contracts (2009-10) 1) Acquisition Cards QA by Contract and 
Services 2) Contracting and Information Monitoring (OCG) (2009-10) 2) Contracting and Procurement Procurement Officers 
*QA on Acquisition Cards 
(holders and purchases) 
¢Internal Control Plan: 
Medium Coverage — procurement 

¢Internal Control Plan: 
Acquisition Cards 


Notes 

Note 1- The effectiveness of the second line of defense activities has not been tested. This column is used to indicate the presence of activities. 

Note 2- The risk and significance rating is a product of the comprehensive risk assessment process that was undertaken during the RBAEP development process. The RBAEP team conducted a risk and 
significant assessment on all audit universe elements which has been rolled up to the DRF level for presentation purposes. 

Factors considered in the detailed assessment include materiality, risks identified during key document reviews, risks identified during consultations, past assurance coverage, outstanding management action 
plans (resulting from previous recommendations), maturity, and alignment with Agency or senior management priorities. 
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Appendix G: 2018-19 DRF 
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